PRIVACY NOTICE (SUPPLEMENTAL)

This Privacy Notice is a supplemental document that outlines how the OSM Thome Group processes the personal data of job applicants (whether as an employee, worker, or contractor).

For general provisions related to Data Protection Principles, Data Security, Data Subject Rights, and the Group's structure, please refer to the OSM Thome General Privacy Notice.

1. PURPOSE

OSM Thome Group consists of different legal entities. This notice is issued on behalf of the OSM Thome Group, so when we mention “OSM Thome Group”, “OSM Thome”, “we”, “us” or “our” in this privacy notice, we are referring to the relevant company in the OSM Thome Group responsible for processing your data.

Please note that the data controller of your personal data will be the entity that you apply to work for, but also entities within the OSM Thome Group among which data is shared for business administration purposes. This means that we are responsible for deciding how we hold and use personal information about you.

You are being provided with this privacy notice because you are applying for work with us. It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. This notice does not form part of any contract with us and may be amended by us at any time.

2. DATA PROTECTION PRINCIPLES

We are committed to processing your data lawfully, fairly, and transparently. For a detailed list of the data protection principles we adhere to, please refer to the OSM Thome General Privacy Notice.

3. THE KIND OF INFORMATION WE HOLD ABOUT YOU

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:

• The information you have provided to us in your curriculum vitae and covering letter.
• The information you have provided when applying with us including name, title, address, telephone number, personal email address, date of birth, gender, employment history, qualifications, certifications, place of birth and nationality.
• Any information you have provided for recruitment purposes to a third-party recruitment agency or online media platforms, for example Webcruiter.com, etc.
• Any information you provide to us during an interview.
• Any notes from the interview process, e.g., tasks completed.

During the recruitment process, we may also collect, store, and use the following "special categories" of more sensitive personal information:

• Information about criminal convictions and offences (where required by law and only after we have made you a job offer and you have accepted that).
• Information about your health, including any medical condition, health and sickness records (where required by the Maritime Labour Convention or any other applicable law and/or health and safety at work).
• Information about any disabilities for which we may need to make adjustments during the recruitment process (but only if you wish to give this to us).

4. HOW IS YOUR PERSONAL INFORMATION COLLECTED?

We collect personal information about candidates from the following sources:

• You, the candidate.
• Our existing employees, as part of a referral policy.
• OSM Thome Group’s internal recruitment agencies.
• A background check provider, from which we may collect relevant data.
• Various police departments in respect of criminal convictions.
• Your named referees or previous employers, from whom we collect your employment history and relevant work experience information, and anyone else identified as a reference by you or by us when reviewing your CV (e.g., former colleagues or suppliers).
• The data collected from third parties from a publicly accessible source, such as Flag State authorities and certification bodies.
• Online third-parties such as recruitment agencies and online media platforms such as LinkedIn.

5. HOW WE WILL USE INFORMATION ABOUT YOU

We will use the personal information we collect about you to:

• Assess your skills, qualifications, and suitability for the job advertised or any other job we may consider you for.
• Carry out background and reference checks, where applicable.
• Communicate with you about the recruitment process.
• To keep you posted on the recruitment process.
• Use it for statistical purposes on our recruitment/hiring process.
• Share it with the hiring manager or any other employee who will be involved in the selection process.
• Keep records related to our hiring processes.
• Comply with legal or regulatory requirements.
• Analyse our interaction with candidates.

It is in our legitimate interests and essential to our business to collect personal data that allows us to determine a person’s suitability for employment. Furthermore, the processing of your personal data enables us to decide whether to enter into a contract of employment with you.

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully.

6. HOW WE USE PARTICULARLY SENSITIVE PERSONAL INFORMATION

We will use your particularly sensitive personal information in the following ways:

• We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example, whether adjustments need to be made during a test or interview.
• For our seafarers, we may use medical data to consider whether you are fit for a specific role on-board a ship. It is required by law that all our seafarers are in adequate physical health and it is our responsibility to ensure you meet the standards.
• For shore staff, we may use medical data to consider if you are eligible for a role which involves frequent traveling and to determine if you are fit to visit our managed vessels.

7. INFORMATION ABOUT CRIMINAL CONVICTIONS

If it is required by law, before we offer you a role, we may collect information about your criminal convictions history. In particular, we may require criminal background checks for certain roles—for example, those working with minors or on-board cruise vessels.

8. DATA SHARING

Why might we share your personal information with third parties?

We will only share your personal information with the following third parties for the purposes of processing your application:

• Internal third parties being other companies in the OSM Thome Group (based in EU as well as in Non-EU countries). The transfer of data between entities within the OSM Thome Group is governed by the Intra Group Data Agreement, which establishes a comprehensive framework for data processing and sharing within the Group in compliance with Data Protection Laws. A list of the companies within the OSM Thome Group is available in Appendix 1 of the General Privacy Notice.
• Clients who may require your personal information for recruitment purposes, such as our ship management clients who require information on the seafarers on-board their vessels.

All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes unless it is provided for in an established Data Sharing Agreement consistent with applicable data protection regulation.

9. INTERNATIONAL TRANSFERS

We share your data with other companies in the OSM Thome Group and our clients, which will involve transferring your data outside the European Economic Area (EEA).

The transfer of Personal Data within the OSM Thome Group, including transfers to a Third Country, is governed by the Intra Group Data Agreement.

Transfer of Personal Data to Third Parties (not covered by the Intra Group Data Agreement): For the transfer of personal data to third parties outside the OSM Thome Group, we will always enter into a Data Processing Agreement (DPA) with the third party. Personal data is only transferred across jurisdictions if the transfer is subject to safeguards ensuring a sufficient level of data protection.

We use safeguards such as transferring data to countries with an adequate level of protection (as deemed by the European Commission) or by implementing Standard Contractual Clauses (SCCs).

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

10. DATA SECURITY

We are committed to the security of your personal data and have implemented appropriate physical, organizational, and technical security measures and procedures to protect your data. For more details on how we protect your personal data, including access control and technical safeguards, please refer to the OSM Thome General Privacy Notice.

11. DATA RETENTION

How long will we use your information for?

We will retain your personal information for 2 years if you are applying for a role on-board one of our vessels and 1 year if you are applying for a role in one of our offices (ashore). We retain your personal information for that period so that we can show, in the event of a legal claim, that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with our data retention policy.

If we wish to retain your personal information on file, for the possibility of a future opportunity, we will ask you separately to provide your explicit consent.

12. YOUR RIGHTS WHEN WE PROCESS YOUR DATA

You have rights in connection with your personal data, including the right to access, rectification, erasure, restriction of processing, objection to processing, and data portability.

For a comprehensive explanation of your rights, including details on how to make a request and our verification process, please refer to the “Your Rights When We Process Your Data” section of the OSM Thome General Privacy Notice.

13. RIGHT TO WITHDRAW CONSENT – RIGHT TO STOP APPLICATION PROCESS

If you no longer want us to process your job application, or wish to withdraw consent where processing is based on consent (such as keeping your data on file for future roles), please contact dpo@osmthome.com. We will then no longer process your data for that purpose and, subject to our retention policy, will dispose of your personal data securely.

14. CONTACT DETAILS

If you have any questions about this privacy notice, how we handle your personal information, or if you wish to exercise any of your rights, please refer to the “Group Privacy Coordinator and Data Protection Officers – Contact Details” section of the OSM Thome General Privacy Notice. This section provides the appropriate contact point for reaching our designated Data Protection Officers and privacy team.

Email: dpo@osmthome.com

You have the right to make a complaint at any time to the concerned supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.