We are an Employment Agency and an Employment Business as defined in the Employment Agencies Act 1973 and the Conduct of Employment Agencies and Employment Businesses Regulations 2003.

We are an employment agency licensed under the Employment Agency Act 1971, and We supply agency workers within the meaning of the Protection of Employees (Temporary Agency Work) Act 2012.

We provide recruitment and placement services (Arbeitsvermittlung) and We supply temporary agency workers (Arbeitnehmerüberlassung). Trinnovo Group Europe GmbH holds a permission to supply temporary agency workers (Erlaubnis zur Arbeitnehmerüberlassung) granted by the Bundesagentur für Arbeit under section 1 of the German Temporary Employment Act (Arbeitnehmerüberlassungsgesetz, AÜG).

We provide recruitment and placement services (Arbeitsvermittlung) and We hire out personnel (Personalverleih) within the meaning of the Federal Act on Employment Services and the Hiring of Services (Arbeitsvermittlungsgesetz, AVG) and its implementing Ordinance (AVV). Our activities are conducted under the licences required by the AVG.

We are a staffing and recruiting company. We place candidates in permanent positions and supply temporary and contract workers to Our clients.

The DPO is appointed in accordance with Article 37 of the GDPR and section 38 of the BDSG.

Matthew Goddard also acts as Our Data Protection Advisor (Datenschutzberater) within the meaning of Article 10 FADP.

Passport copies, driving licence copies, biometric residence permits, share codes, visa records and other immigration documents; bank account details, National Insurance number, tax status information, payroll information.

Passport copies, driving licence copies, employment permit records, immigration permission stamps and other immigration documents; bank account details, PPS number, tax status information, payroll information.

Identity card or passport copies, residence titles (Aufenthaltstitel), work permission records and other immigration documents; bank account details, tax identification number (Steuer-Identifikationsnummer), social security number (Sozialversicherungsnummer), tax class information, payroll information.

Identity card or passport copies, residence and work permits (including permit categories B, C, G and L), notification records under the notification procedure for short-term work, and other immigration documents; bank account details, AHV number, withholding tax (Quellensteuer) status, pension fund information, payroll information. We may also collect your place of origin (Heimatort) where applicable.

Social Security number, driver's license or state identification card number, passport number; bank account details for payment, tax withholding information, benefits elections, and compensation history where lawfully collected. We may also collect education information, commercial information relating to services provided, and internet and electronic network activity information arising from your interactions with Our websites, job portals and marketing communications.

Information relating to basic working and employment conditions, for the purpose of complying with the equal treatment requirements of the Protection of Employees (Temporary Agency Work) Act 2012.

Information relating to essential working conditions, for the purpose of complying with the equal treatment and equal pay requirements of sections 8 and 9 AÜG, and information required for the assignment records We are obliged to maintain under section 7 AÜG. Where a collective bargaining agreement (Tarifvertrag) applies to your engagement, We also process working time and working time account data as necessary to apply the terms of that agreement.

Information relating to working conditions and hours, for the purpose of complying with Our obligations under the AVG, the Employment Act (Arbeitsgesetz) and any applicable collective employment agreement (Gesamtarbeitsvertrag).

Assignment and placement records, and timesheets.

In limited cases We process special category personal data, such as health information for accessibility and reasonable adjustment purposes. Where We do so, We rely on a condition under Article 9 of the applicable GDPR.

Where required, We also rely on a condition in Schedule 1 to the Data Protection Act 2018.

We rely on Article 9(2) GDPR together with the safeguards required by section 22 BDSG. This may include data relating to severe disability status where necessary to comply with obligations under Book IX of the Social Code (SGB IX).

In limited cases We process sensitive personal data within the meaning of Article 5(c) FADP. In Our business this may include health information collected for accessibility and workplace adjustment purposes, and information concerning administrative or criminal proceedings and sanctions. Where We do so, We rely on a justification under Article 31 FADP, in particular your express consent or an overriding private interest.

Some of the information We collect is treated as sensitive personal information under state privacy laws, including Social Security numbers and other government identifiers, financial account information, racial or ethnic origin, and health or disability information. We use and disclose sensitive personal information only for the purposes described in this notice and as permitted by applicable law. We do not use or disclose sensitive personal information for purposes of inferring characteristics about you. Where We collect characteristics of protected classifications under federal or state law, including date of birth, gender, race and ethnicity, veteran status and disability status, it is for equal employment opportunity, affirmative action, accommodation or benefits administration purposes, and it is provided on a voluntary basis unless a specific legal obligation applies.

Where a client engagement or applicable law requires it, We process personal data relating to criminal convictions and offences under Article 10 of the UK GDPR and a condition in Schedule 1 to the Data Protection Act 2018, supported by an Appropriate Policy Document as required by that Act. Checks are carried out through the Disclosure and Barring Service or its equivalents in Scotland and Northern Ireland, via Our screening provider.

Where an engagement involves work with children or vulnerable persons, We may facilitate vetting through the National Vetting Bureau under the National Vetting Bureau (Children and Vulnerable Persons) Acts 2012 to 2016. Outside those circumstances, We do not require or process criminal records information in respect of engagements in Ireland.

We do not require a certificate of good conduct (Führungszeugnis) as a matter of routine. Where a specific role or a legal requirement makes such a check necessary and proportionate, We will explain the basis for the request before it is made.

Where a specific role or a legal requirement makes such a check necessary and proportionate, We may process information concerning administrative or criminal proceedings and sanctions, as described above.

See "Background Checks and Consumer Reports" below.

Where We obtain your personal data from a source other than you, We will provide you with this notice within a reasonable period, and in any event within one month, in accordance with Article 14 of the applicable GDPR.

Where We obtain your personal data from a source other than you, We will inform you in accordance with Article 19 FADP.

The Conduct of Employment Agencies and Employment Businesses Regulations 2003; the off-payroll working rules in Chapter 10 of Part 2 of ITEPA 2003; right-to-work verification under the Immigration, Asylum and Nationality Act 2006 and Home Office guidance.

The Employment Agency Act 1971 and the Protection of Employees (Temporary Agency Work) Act 2012; right-to-work verification including under the Employment Permits Act 2024 where you are not a national of the European Economic Area or Switzerland.

The AÜG and Book III of the Social Code (SGB III); wage tax and social security contribution obligations; verification of entitlement to work under the Residence Act (Aufenthaltsgesetz) and the Employment Ordinance (Beschäftigungsverordnung); defending claims under the General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, AGG).

The AVG and AVV; social insurance obligations including AHV/IV/EO, unemployment insurance, occupational pension and accident insurance; verification of entitlement to work under the Foreign Nationals and Integration Act (Ausländer- und Integrationsgesetz) and, where applicable, the Agreement on the Free Movement of Persons.

Federal, state and local obligations including employment eligibility verification through completion of Form I-9 as required by the Immigration Reform and Control Act, tax withholding and reporting, equal employment opportunity reporting, workers' compensation and unemployment insurance administration, and recordkeeping requirements.

The legal basis on which We rely depends on the activity.

• Performance of a contract, or steps taken at your request prior to entering into a contract (Article 6(1)(b)) — where We are negotiating or have entered into a placement, employment or services agreement with you or with the entity engaging you.
• Legitimate interests (Article 6(1)(f)) — for the operation and development of Our recruitment business, including matching candidates to clients, maintaining Our database of candidate and client information, business-to-business marketing, and managing Our business operations. We balance Our interests against your rights and freedoms in each case, and you may request a copy of the relevant balancing assessment.
• Legal obligation (Article 6(1)(c)) — where We are required to process your personal data to comply with applicable law, for example right-to-work checks, tax obligations and regulatory record-keeping requirements.
• Consent (Article 6(1)(a)) — for specific activities for which We seek your consent, for example certain electronic marketing communications, or retention of your application in Our talent pool beyond the periods described below. Where We rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Where consent is given in the context of an employment relationship, We assess it in accordance with section 26(2) BDSG. Section 26 BDSG contains supplementary provisions on the processing of employee data. Following the judgment of the Court of Justice of the European Union of 30 March 2023 (Case C-34/21), We do not rely on section 26(1) sentence 1 BDSG as a free-standing legal basis, and each processing activity is assessed against the requirements of the GDPR itself.

Under Swiss law, a private controller does not require a legal basis before processing personal data. We process personal data in accordance with the principles set out in Articles 6 and 8 FADP: lawfulness, good faith, proportionality, purpose limitation, transparency, accuracy and data security. Where Our processing would otherwise breach your personality rights within the meaning of Article 30 FADP, We rely on a justification under Article 31 FADP, being your consent, an overriding private or public interest, or a provision of law. Where you are employed by Us, We process your personal data in accordance with Article 328b of the Code of Obligations, which permits Us to process data concerning you only in so far as that data concerns your suitability for the employment relationship or is necessary for the performance of the employment contract.

United States law does not require Us to identify a legal basis before processing personal information. We process personal information for the business and commercial purposes described above, and only in ways consistent with the notice We have given you and with applicable federal and state law.

Where a client engagement or applicable law requires it, We may obtain a consumer report or investigative consumer report about you from a consumer reporting agency. This may include verification of employment and education history, criminal history where permitted by law, motor vehicle records, and in limited circumstances credit history where the role and applicable state law permit it. We will not obtain such a report without first providing you with a clear and conspicuous written disclosure in a document consisting solely of that disclosure, and obtaining your written authorization, as required by the federal Fair Credit Reporting Act and applicable state fair credit reporting laws. If We intend to take adverse action based in whole or in part on the contents of such a report, We will provide you with a copy of the report, a summary of your rights, and an opportunity to respond before taking final action. We comply with applicable state and local laws restricting inquiries into criminal history, salary history and credit history, including laws which restrict when such inquiries may be made in the hiring process.

We do not sell your personal information, and We do not share your personal information for cross-context behavioral advertising, as those terms are defined under state privacy laws. We have not sold or shared personal information in the twelve months preceding the date of this notice. Certain state privacy laws require Us to treat the transmission of information to advertising and analytics providers through Our websites as a sale or sharing in some circumstances. Where that is the

case, Our Cookie Notice explains the controls available to you, and We honor opt-out preference signals, including the Global Privacy Control, transmitted by your browser.

HM Revenue & Customs, the Employment Agency Standards Inspectorate and the Home Office.

The Revenue Commissioners, the Workplace Relations Commission and the Department of Enterprise, Tourism and Employment.

The tax authorities (Finanzämter), social security institutions, health insurance funds (Krankenkassen), the Bundesagentur für Arbeit and, in relation to the AÜG permission, the competent supervisory authorities.

Social insurance institutions, pension funds, accident insurers, tax authorities and, in relation to Our AVG licences, the competent cantonal authority and the State Secretariat for Economic Affairs (SECO). We are bound by a duty of confidentiality in respect of the personal data of jobseekers and hired-out personnel under Articles 7 and 18 AVG. Our employees are subject to corresponding confidentiality obligations.

The Internal Revenue Service, state tax and labor agencies, the Social Security Administration, the Department of Homeland Security and the Equal Employment Opportunity Commission, and consumer reporting agencies and background screening providers.

Where state or local law requires notice, consent, or an independent bias audit before an automated employment decision tool is used, We will provide the required notice and comply with the applicable requirements before any such tool is used in connection with your application.

On 19 December 2025 the European Commission renewed its adequacy decision in respect of the United Kingdom under Article 45 of the GDPR. That decision is currently in force. Transfers of personal data from the EEA to Our United Kingdom entities are made on the basis of that adequacy decision, and are additionally supported by the Standard Contractual Clauses adopted by the European Commission within Our intra-group arrangement, which would apply should the adequacy decision cease to have effect. Where personal data is transferred to a country outside the European Economic Area that is not the subject of an adequacy decision, We apply an appropriate transfer mechanism under Chapter V of the GDPR, including the Standard Contractual Clauses supported by a transfer impact assessment, or the EU-US Data Privacy Framework where the US recipient is appropriately certified.

Where personal data is transferred outside the United Kingdom, We apply an appropriate transfer mechanism under Chapter V of the UK GDPR, including UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses supported by a transfer risk assessment, or the UK Extension to the EU-US Data Privacy Framework where the US recipient is appropriately certified.

Personal data collected in Switzerland is transferred to the United Kingdom, and is also accessed remotely from the United Kingdom, which under Swiss law constitutes a disclosure abroad. The United Kingdom is listed in Annex 1 to the Data Protection Ordinance as a State which guarantees an adequate level of data protection. Disclosures from Switzerland to Our United Kingdom entities are accordingly made on the basis of Article 16 paragraph 1 FADP, without the need for additional safeguards. Where personal data is disclosed to a State which is not listed in Annex 1, We ensure adequate protection by other means in accordance with Article 16 paragraph 2 FADP, including standard data protection clauses approved, issued or recognised in advance by the Federal Data Protection and Information Commissioner (in particular the Standard Contractual Clauses adopted by the European Commission with the amendments required under Swiss law), or the Swiss-US Data Privacy Framework where the recipient is appropriately certified. You may request further information about the safeguards applied, and a copy of the relevant documentation, by contacting gdpr@trinnovo.com.

By providing personal information to Us, you understand that it will be transferred to, stored in, and processed in countries outside the United States, which may have data protection rules that differ from those of your state. We apply the same protections to your personal information wherever it is processed, and Our intra-group data transfer arrangement requires each receiving entity to maintain appropriate safeguards.

Records required by the Conduct of Employment Agencies and Employment Businesses Regulations 2003 are retained for at least one year. Employee data is retained for the duration of employment and for six years thereafter, in line with UK tax and employment law and the limitation period under the Limitation Act 1980. Right-to-work documentation is retained for the duration of the engagement and for two years after it ends, in line with Home Office guidance. Financial and tax records are retained for six years from the end of the relevant accounting period. Criminal records information is not retained beyond the recruitment decision unless a specific legal or contractual requirement applies.

Records required to be kept by a licensed employment agency are retained under the Employment Agency Act 1971. Employee and agency worker data is retained for the duration of the engagement and for six years thereafter, in line with the limitation period under the Statute of Limitations 1957. Working time records are retained for at least three years under the Organisation of Working Time Act 1997. Right-to-work and employment permit documentation is retained for the period required under the Employment Permits Act 2024. Financial and tax records are retained for six years under the Taxes Consolidation Act 1997 and the Companies Act 2014.

Where an application is unsuccessful, applicant data is retained for six months following the conclusion of the application procedure, to enable Us to respond to any claim under the AGG; longer retention in Our talent pool takes place only with your consent. Assignment records are retained under section 7 AÜG. Payroll tax records are retained under section 41 of the Income Tax Act (Einkommensteuergesetz). Social security records are retained under section 28f SGB IV until the end of the calendar year following the last completed audit. Financial, accounting and tax records are retained for the periods required by section 257 of the Commercial Code (Handelsgesetzbuch) and section 147 of the Fiscal Code (Abgabenordnung), being up to ten years. Minimum wage records are retained for at least two years under section 17 of the Minimum Wage Act (Mindestlohngesetz).

Placement and hiring records are retained under the AVG and AVV. Employee and hired-out personnel data is retained for the duration of the engagement and for ten years thereafter, in line with the general limitation period under Article 127 of the Code of Obligations. Working time and rest period records are retained for at least five years under the Employment Act and Ordinance 1 to the Employment Act. Social insurance and pension records are retained for the periods required under the Federal Act on Old Age and Survivors Insurance and related legislation. Accounting, financial and tax records are retained for ten years under Article 958f of the Code of Obligations.

Application and hiring records are retained for the period required under Title VII of the Civil Rights Act, the Age Discrimination in Employment Act, the Americans with Disabilities Act and the regulations of the Equal Employment Opportunity Commission, and for longer where a charge or claim is pending. Employment eligibility verification records (Form I-9) are retained for the duration of employment and thereafter for the period required by federal immigration law. Payroll and wage records are retained under the Fair Labor Standards Act, the Internal Revenue Code and applicable state wage and hour laws. Benefits and retirement plan records are retained under the Employee Retirement Income Security Act. Consumer report information is disposed of securely in accordance with the disposal rule under the Fair and Accurate Credit Transactions Act.

These measures are implemented as required by Article 32 of the applicable GDPR.

These measures are implemented as required by Article 8 FADP and Articles 1 to 4 of the Data Protection Ordinance. Where a breach of data security is likely to result in a high risk to your personality or fundamental rights, We will notify the Federal Data Protection and Information Commissioner as soon as possible, and will inform you where necessary for your protection or where the Commissioner so requires.

We maintain a written information security program with administrative, technical and physical safeguards appropriate to the nature of the personal information We hold, including as required by the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00) and other applicable state data security laws. Where a breach of the security of personal information occurs, We will notify affected individuals and, where required, state regulators, in accordance with applicable state breach notification laws.

Non-essential cookies are set only with your consent, in accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003.

Non-essential cookies are set only with your consent, in accordance with S.I. No. 336 of 2011.

Cookies and similar technologies which are not strictly necessary are used only with your consent, in accordance with section 25 of the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG).

Our use of cookies is described in accordance with Article 45c of the Telecommunications Act.

We honor opt-out preference signals, including the Global Privacy Control, transmitted by your browser.

You have the following rights.

• Right to be informed — about how We use your personal data (this notice forms part of how We comply).

• Right of access — to obtain a copy of the personal data We hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to have your data deleted in certain circumstances.
• Right to restrict processing — to limit how We use your data in certain circumstances.
• Right to object — to certain processing, including direct marketing.
• Right to data portability — to receive your data in a portable format for transfer to another organisation.
• Right to withdraw consent — at any time, where Our processing is based on your consent.
• Rights in relation to automated decision-making and profiling — to the extent applicable. As stated above, Our services do not include solely automated decision-making producing legal or similarly significant effects.

Sections 32 to 37 BDSG contain limited exceptions to and restrictions on certain of these rights. Where such an exception applies to your request, We will tell you.

You have the following rights.

• Right to information — to be informed about the collection of your personal data (this notice forms part of how We comply).
• Right of access (Article 25 FADP) — to obtain confirmation of whether We process personal data concerning you, and the information necessary for you to exercise your rights.
• Right to rectification (Article 32 FADP) — to have inaccurate personal data corrected.
• Right to request deletion or destruction of your personal data.
• Right to object to a particular processing activity, and to request that a disclosure to third parties be prohibited.
• Right to data portability (Article 28 FADP) — to request the release of your personal data in a commonly used electronic format, or its transfer to another controller, where We process it by automated means with your consent or in connection with a contract.
• Right to a note of contestation attached to your data, where neither the accuracy nor the inaccuracy of the data can be established.
• Rights in relation to automated individual decision-making (Article 21 FADP) — to be informed of, and to request review of, any decision taken solely by automated processing which has a legal consequence for you or affects you significantly. As stated above, Our services do not include such decisions.

State privacy laws give residents of certain states rights over their personal information, and the rights available under law depend on the state in which you reside. As a matter of Our practice, We make the following rights available to all individuals in the United States whose personal information We hold.

• Right to know — to confirm whether We process personal information about you, and to obtain the categories of information collected, the sources, the purposes, and the categories of recipients.
• Right of access — to obtain a copy of the specific pieces of personal information We hold about you, in a portable format where technically feasible.
• Right to correct — to have inaccurate personal information corrected.
• Right to delete — to have your personal information deleted, subject to the exceptions provided by law, including where We are required to retain it.
• Right to opt out of sale or sharing — although, as stated above, We do not sell or share personal information.
• Right to limit the use of sensitive personal information — to direct Us to limit Our use of sensitive personal information to what is necessary to provide Our services.
• Right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects — although, as stated above, We do not make such decisions by automated means alone.
• Right to appeal — to appeal a decision We make in response to any of the requests above.
• Right to non-discrimination — We will not discriminate against you, deny you services, or treat you differently as a candidate or worker because you exercised any of these rights.

This is provided for by Article 3 paragraph 1 letter o of the Unfair Competition Act.

We will honor your request promptly and in any event within the period required by the CAN-SPAM Act and applicable state law.

Where We process your personal data on the basis of Our legitimate interests, you may object at any time on grounds relating to your particular situation. We will stop that processing unless We can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

You may object to Our processing of your personal data at any time. Where you do so, We will cease the processing concerned unless We can establish a justification under Article 31 FADP, being an overriding private or public interest or a provision of law, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

You may object to Our use of your personal information at any time by contacting Us. Where the law gives you a right to opt out, to limit the use of sensitive personal information, or to require deletion, We will honor that request as described above.

You may contact the Attorney General of your state. Residents of California may contact the California Privacy Protection Agency.

You may lodge a complaint with the supervisory authority in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, whether or not that authority is listed above.

You also have the right to an effective judicial remedy under Article 79 of the applicable GDPR.

You may in addition bring civil proceedings before the competent Swiss court under Articles 32 FADP and 28 et seq. of the Civil Code.