DATA PROTECTION NOTICE FOR EXTERNAL CANDIDATES

1. Introduction

Our commitment to data protection

At Danone ("Danone", "we" or "us"), we attach great importance to protecting your personal data. As a controller, we manage your personal data responsibly and are committed to ensuring transparency in our processing of personal data. Details of the procedures we follow can be found in this Data Protection Notice for External Candidates ("Data Protection Notice").

The controller of your personal data is the selected company from the Danone Group where you apply for employment, i.e:

Nutricia Polska Sp. z o.o. based in Warsaw, 8 Bobrowiecka Street, 00-728 Warsaw, KRS 0000121361, NIP 824-100-08-56; Data Protection Officer: iod.nutricia@danone.com;
Nutricia Zakłady Produkcyjne Sp. z o.o. with its registered office in Opole, 1 Marka z Jemielnicy St., 45-952 Opole, KRS 0000000515, NIP 7540335340; data protection inspector: iod.nutricia-zaklady@danone.com;
Żywiec - Zdrój S.A. with the seat in Cięcin, 187 Św. Katarzyny St., 34-350 Węgierska Górka, KRS 0000027034; NIP 553-00-16-738, Data Protection Inspector: iod.zywiec-zdroj@danone.com;
DANONE spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, ul. Redutowa 9/23, 01-103 Warsaw, KRS: 0000014227, NIP: 5270204471, Data Protection Inspector: iod.danone@danone.com.

Hereinafter collectively referred to as "DANONE" or "we".

This Data Protection Notice

This Data Protection Notice applies to you if you apply for a job with Danone ("Candidate") and describes the processing of your personal data. You are considered a Candidate until you receive a formal rejection or sign an employment contract with our company.

If you are already a Danone Employee within the European Union ("EU"), please read the Data Protection Notice for Employees. If you are located outside the EU, please contact

your HR team for more information on the processing of your personal data as a Danone Employee.

2. Core principles and our commitment to data protection

In ensuring the protection of a Candidate's personal data, we act in accordance with the following basic principles:

The Candidate is not obliged to provide any of the data we ask for. However, if you choose not to provide it, we may not be able to assess your suitability for the job, which may result in your application being rejected.
We will only collect and process Candidate Data for the purposes set out in this Data Protection Notice or for the specific purposes notified to you and/or approved by you. Candidate Data will not be processed in any way incompatible with these purposes.
We will only collect, process and use the necessary data to the minimum extent and no more than is necessary to fulfil the purposes set out in this Data Protection Notice.
When we process a Candidate's data, we take reasonable steps to ensure, as far as possible, that it is accurate and up to date.
We are committed to protecting Candidate data from misuse, interference, loss, unauthorized access, modification or disclosure. To this end, we have put in place a number of security measures to protect Candidate data.
In general, we will retain the data we collect for the period necessary for the purposes of the processing (see retention periods set out in this Data Protection Notice).
Your Candidate Data will not be shared, sold, rented or disclosed other than as described in this Privacy Notice.

In addition, we process your personal data in accordance with applicable data protection laws, viz:

the General Data Protection Regulation ("GDPR");
the applicable laws of the Member States;
any mandatory guidelines or recommendations implementing the RODO or the applicable laws of the Member States.

(collectively "Applicable Laws").

3. What personal data we process

Collected when you browse our website

We collect browser history data such as pages visited, date of access, location accessed and IP address;
Data is collected indirectly from the Candidate and generated by Danone: We may also collect Candidate Personal Data indirectly when Candidate shares content on social media, websites or apps related to our services or in response to our social media advertising and promotional activities.
We collect data from cookies and other technologies. See Section 9.

Data collected directly from the Candidate and generated by Danone

Danone collects personal data directly from the Candidate when they apply for a job at Danone. Additionally, we may also generate personal data about the Candidate as part of the recruitment process, such as by taking notes during interviews.

This personal data may include:

Candidate's name, gender for diversity policy purposes, age, nationality, contact details, home address, country of residence, photo (if available), video (if available), languages;
education (including certifications);
Work experience (history, years of experience, current employer, current position, experience managing a team);
skills and competencies;
interview notes;
career interests and preferences;
geographic mobility;
Current salary and expected compensation;
Previous Danone job applications and/or status;
various interactions/meetings with Danone.

Additional categories of personal data

Recruiters may request and process additional information in certain situations as necessary to assess compatibility with a specific role. For example, if the position requires driving, the recruiter will ask the Candidate about their driver's license. In addition, please note that local laws may require us to request additional information about a Candidate.

When we collect data, we indicate in the job description at what point we will need to collect the data to evaluate your application or to comply with legal requirements.

If you do not provide this data, we may not be able to assess your suitability for the position, which may result in Danone automatically rejecting your application.

Data obtained from third parties: we may also obtain personal data about you from other sources such as third party service providers (e.g., recruitment or talent agencies). For example, if a Candidate has started the application process for a specific position at Danone through an external recruitment agency, such agency may provide us with your data.

Sensitive data

Depending on the Candidate's country of residence, sensitive data includes data revealing racial or ethnic origin, health data, data on criminal convictions and violations of law, and identification numbers assigned by government authorities (passport number, ID number, social security number, etc.).

As a general rule, Danone does not process sensitive data about a Candidate unless the nature of the function requires the processing of such information and only if permitted under Applicable Laws. For example, it may be relevant to provide information on allergies when filling positions in certain production areas. Danone will also process sensitive data about a Candidate if required to do so under local laws. In this case, we will notify the Candidate in advance.

4. WHY DO WE COLLECT AND USE CANDIDATE PERSONAL DATA?

In accordance with Applicable Laws, if you are located in the EU, we will only process your personal data for the specific and legally permitted purposes described in this Privacy Notice, such as:

Legitimate legitimate interest: to manage the recruitment, assessment and confirmation (if applicable) of the Candidate's suitability for employment;

Contract: to prepare a job offer for the Candidate and an employment contract if the Candidate is hired;
Legal obligations: to comply with our legal obligations (excluding contractual obligations); For example: to comply with local employment law; and
Consent: by applying for a job offer, you may consent to your personal information being shared with recruiters outside your country of residence.

If the Candidate is not hired for the position applied for, Danone may retain and use the Candidate's data for up to 1 year from the date of the Candidate's application or account creation to consider the Candidate's candidacy for other positions if the Candidate has consented to have the data processed for future recruitment. If a Candidate wishes to have his or her data removed from our systems, he or she may withdraw their consent following the process described in this Privacy Notice.

If you are located outside of the EU and if the applicable law of your country of residence requires your consent to the collection and processing of personal data, applying for a position with Danone is equivalent to providing the necessary consent.

We may also process the Candidate's personal data without the Candidate's consent, but always to the extent permitted by Applicable Law.

Purpose Legal basis

To manage the recruitment processes,

To assess and confirm (if applicable)

The suitability of candidates for

employment (including verification of

of personal data and references). Necessary for the performance of the contract.

To comply with our legal obligations

To prepare a job offer to

Candidates and the employment contract in the event

their employment; Necessary due to our legitimate interest

legal obligations, such as compliance with Necessary to comply with legal obligations.

local labor laws.

Sharing personal information

of candidates to recruiters outside their country of residence. Consent

To apply for another job offer at

Danone or allow us to

Contact candidates for

Other available positions that we

We consider compatible with the profiles of

candidates, Consent

To select candidates' application and

check the compatibility and suitability

solely by automatic means. Consent

5. Retention Period

We will retain Candidate's personal information on our systems only for the time necessary to fulfill the purposes for which we collected it, as described in this Privacy Notice, including to satisfy any legal or accounting requirements. Thereafter, we will delete the personal information from our systems or permanently and irreversibly anonymize it for statistical purposes, meaning that the Candidate cannot be linked to it.

Danone may also store and use the Candidate's personal data for up to 1 year from the date of application or creation of an account by the Candidate in the context of general job postings published on the Danone website, in order to include the Candidate in the recruitment process for available positions compatible with the Candidate's profile.

If the Candidate does not want his or her application to be considered for recruitment for other positions or wants his or her data to be deleted from our systems, he or she may request Danone to do so at any time, subject to the legal requirements for processing based on the consent given before revocation.

Please note that under Applicable Laws, a Candidate's personal data may be retained for a limited period of time due to Danone's legitimate interests and/or to comply with our binding legal obligations.

If you did not apply directly (e.g., your application was submitted through a recommendation process or through a third party (see Section 3)), you will have 3 months to accept our Data Protection Notice. If the Candidate does not accept it within this period, their personal data will be deleted.

If the Candidate is hired by Danone after the recruitment process has been completed, the Candidate's personal data may be used in connection with the Candidate's employment in accordance with Danone's data protection policies and guidelines, which will be provided to the Candidate after hiring.

6. TRANSFER OF THE CANDIDATE'S DATA TO THIRD PARTIES AND/OR OUTSIDE THE CANDIDATE'S COUNTRY OF RESIDENCE

Sharing of Candidate data with third parties:

When we share Candidate data with our affiliates and other entities, we ensure that they are only those entities that safeguard and protect Candidate data and comply with Applicable Laws in the same or similar manner as we do.

Trusted third parties may assist us in providing IT services, such as platform providers, hosting services, individuals associated with the maintenance and support of our databases as well as our software and applications that may contain Candidate Data or perform statistical analysis on our behalf related to the use of the Careers website.

More specifically, the categories of recipients to whom Candidate Personal Data may be shared are as follows:

Outside of Danone:

IT service providers (platform provider, hosting services)
Cloud service providers;
External advisors/agencies and consultants;
Public authorities;
external recruiters.

At Danone:

the global team at Danone headquarters and the HR departments of the various Danone affiliates and subsidiaries;
other internal Danone teams (such as IT and potential manager(s), only on a need-to-know basis and only for the purpose of providing the services needed by the Candidate (e.g. solving technical problems or approvals in the system...)

Candidate Data will not be shared, sold, rented, or disclosed other than as described in this Privacy Notice. However, we may share Candidate Data if required to do so by law and/or governmental authorities.

Sharing of Candidate's personal information with other countries:

Our servers are located in the EU. Your personal data may be processed outside your country of residence, including outside the EEA in the context of a job application; you may choose to share your personal data with recruiters outside your country of residence.

As a result, Candidate's personal data may be subject to the laws of a jurisdiction other than Candidate's.

Accordingly, the Candidate agrees and accepts that by providing us with his or her personal information to apply for a particular position, and in particular by choosing to share his or her personal information with recruiters outside his or her country of residence, he or she consents to the transfer of his or her personal information in the manner described in this Privacy Notice.

In all cases, Danone will ensure the protection of such cross-border data processing using appropriate safeguards.

Additional information about DANONE S.A. and its subsidiaries ("DANONE") is available at https://www.danone.com/. Information on individual Danone Group companies is available on the websites of those companies.

7. AUTOMATED INDIVIDUAL DECISION-MAKING AND PROFILING

Automated individual decision-making

In some cases, we may process a Candidate's personal data by automated means. This means that decisions regarding your application are made solely by automated means, without human involvement in the decision-making process.

To enable us to process the Candidate's personal data automatically, the Candidate consents to the automated processing. If we do so, we will provide the Candidate with understandable information in the job description about our decision to use automated processing, the logic involved, and the significance and anticipated consequences of such processing for the Candidate.

Under applicable law, a Candidate has certain rights with respect to automated decision-making if such decisions would have a

him or her a significant impact. See Section 9 "Candidate Rights" for more information about your rights as a Candidate.

Profiling

We may process a Candidate's personal data for profiling purposes to predict their behavior on our website or job offers and content that may be of interest to them.

When we send or display personalized communications, content, job offers, we may use certain techniques that qualify as "profiling" (i.e., any form of automated processing of personal data concerning an individual involving the use of that data to evaluate certain personal aspects relating to the individual, in particular relating to the analysis or prediction of aspects concerning the individual's personal preferences, interests, work experience, skills, economic situation, behaviour, location, reliability and movements).

This means that we may collect Candidate personal data through cookies. We centralize this data and analyze it to assess and predict a Candidate's personal preferences, skills and/or interests related to the position. For additional information about cookies, please see our Cookie Statement.

Based on our analysis, we send or display communications and/or content tailored to the Candidate's interests/needs.

Under Applicable Laws, you have the right to object to the use of your personal information for "profiling" purposes under certain circumstances. See Section 9 "Candidate Rights" for more information about your rights.

8. HOW WE PROTECT PERSONAL INFORMATION

We understand that the security of a Candidate's personal information is paramount. We work hard to protect personal information from misuse, interference, loss, unauthorized access, modification or disclosure. We have implemented a number of security measures to protect Candidate personal information. For example, we implement access controls, use firewalls and secure servers, and encrypt personal information. Please note, however, that the security of the data you transmit to us over the Internet can never be 100% guaranteed.

9. YOUR RIGHTS

You have certain rights in relation to our processing of your data under Applicable Laws.

Unless otherwise indicated below, you may exercise your rights through your User Account or by email (see Section 11 "Contact Us" below).

Please note that if a Candidate deletes his or her User Account, he or she will no longer be able to use certain sections of the Site or receive alerts about jobs for which he or she has signed up, and Danone will not be able to assess his or her compatibility with the job, which may result in the rejection of his or her application.

If required by Applicable Law, you have the right to:
request access to the information we hold about you;
Have your personal data rectified if it is inaccurate or incomplete
request erasure of your personal data if:
(a) his or her personal data is no longer necessary for the purposes for which we collected it; or (b) he or she withdraws consent to the processing of his or her personal data that he or she has previously given us, where there is no other legal basis for processing the personal data; or
c) you object to our processing of your personal data for direct marketing purposes; or
(d) you object to our processing of your personal data on the basis of Danone's legitimate interests (such as improving your overall experience when using our websites);
(e) your personal data is not processed lawfully; or
(f) his or her personal data must be erased in order to comply with a legal obligation;
(g) in other special circumstances determined by local law.
withdraw your consent

When we process your personal data based on your consent, you may withdraw that consent at any time. However, withdrawal of consent is subject to the legal requirements for processing prior to withdrawal.

Please note that if a Candidate deletes his or her User Account, he or she will no longer be able to use certain sections of the site or receive alerts about job openings to which he or she has signed up.

In addition, Danone will not be able to assess your suitability for the position, which may result in the rejection of your application.

restrict our processing of your personal data (i.e., allow us to store it but not to further process it)

You may have the right to restrict the processing of your data if

(a) you believe that personal data we hold about you is inaccurate; or

(b) your personal data is not being processed lawfully but you would prefer that we restrict the processing instead of erasing it; or

(c) your personal data is no longer necessary for the purposes for which we collected it, but you need it in order to establish, exercise or defend legal claims; or

(d) he or she has objected to the processing of his or her personal data and is waiting for verification that his or her interests in doing so outweigh the legitimate grounds for processing his or her data.

object to processing

A candidate may have the right to object to processing involving direct marketing and activities related to processing based on legitimate interests.

Not be subject to decisions which are based solely on automated processing, including profiling, which produce legal effects concerning them or significantly affect them in a similar way.

In these situations, you have the right to human participation in the decision-making process and we will provide you with the means to express your point of view and/or challenge the automated decision.

The right not to be subject to decisions based on automated processing does not apply if the decision made:

is necessary for the conclusion or performance of a contract with the Candidate;
is mandated by applicable law and appropriate measures exist to protect your rights, freedoms, and legitimate interests; or
is based on your explicit consent.

Please note that in these situations, you still have the right to human involvement in the decision-making process and we will provide you with appropriate means to express your point of view and/or challenge the automated decision.

request portability of your data

Your Candidate Data may be ported. This means that it can be transferred, copied or transmitted electronically. However, this right only applies if:

(a) the processing takes place with the Candidate's consent;

(b) the processing takes place for the performance of a contract;

lodge a complaint with the supervisory authority in your country

Supervisory Authorities for Europe: https://edpb.europa.eu/about-edpb/board/members_en. In Poland, the supervisory authority is the President of the Office for Personal Data Protection with its seat in Warsaw.

In some countries, you may have additional rights under local laws and regulations, such as giving us instructions on how to use your personal information after your death.

Please note that these rights are not absolute and may vary from country to country.

In all cases, if the information we collect is no longer needed for any purpose, and Applicable Law does not require us to retain it, we will do our best to delete, destroy or permanently anonymize it.

10. COOKIES AND OTHER TECHNOLOGIES

We may also collect Candidate's personal information through the use of cookies and other technologies. This may occur when a Candidate visits our sites or third party sites, browses our online promotions, or uses our mobile applications/third party mobile applications and may include the following information:

(a) Information about the browser and operating system that the Candidate is using;

(b) The IP address of the device the Candidate is using;

(d) Links that the Candidate clicks on when interacting with our site.

Please see our Cookie Statement for additional information.

11. CONTACT

If you have any questions, comments or complaints regarding this Data Protection Notice or the processing of your personal data, or to make a claim regarding any of your data protection rights, please contact us using the contact list below drawn up for each country.

For data protection issues, the Danone Group companies in Poland can be contacted via the e-mail addresses indicated in the introduction of this Data Protection Notice.

All other employment related inquiries should be made through the careers website.

Argentina: Compliance.CONOSUR@danone.com

Austria: Talent-Team-Dach@danone.com

Baltic Region (Estonia, Latvia, Lithuania): privacy.candidate-BALTICS@danone.com

Bulgaria: consumers.line@danone.com

Belgium: privacyHR.benelux@danone.com

Brazil: protecaodedados@danone.com

Czech Republic: danone@teleperformance.cz

France: dpo.france@danone.com

Germany: Talent-Team-Dach@danone.com

Greece: privacy.candidateITGR@danone.com

Hungary: danoneinfo@danone.hu

Indonesia: Admin.HRGroupe@danone.com

Ireland: DanonePrivacy.UKMB@danone.com

Italy: privacy.candidateITGR@danone.com

Netherlands: privacyHR.benelux@danone.com

Malaysia: mycareline@dugro.com.my

Mexico: Compliance.MX@danone.com

NORAM (United States and Canada): Compliance-NORAM@Danone.com

Nordic Region (Sweden, Norway, Finland, Denmark): privacy.candidate-NORDICS@danone.com

Poland: Iod.rekrutacja@danone.com

Portugal: danone.informa@danone.com

Romania: callcenter@mediasat.ro

Singapore: michelle.ang@danone.com

Spain: lopd.talent@danone.com

Slovakia: danone@teleperformance.sk

Switzerland: Talent-Team-Dach@danone.com

United Kingdom: DanonePrivacy.UKMB@danone.com

Uruguay: Compliance.CONOSUR@danone.com

For Alpro (France, Netherlands, Germany, United Kingdom and Belgium): alpro.dataprotection@alpro.com

Danone Corporate can also be contacted at: HRprivacy.groupe@danone.com

You can also contact our Data Protection Officer at the following address: dpo.group@danone.com

Data Protection Officer

Danone

17 boulevard Haussmann

75009 Paris

12. MODIFICATIONS TO THIS DATA PROTECTION NOTICE

Danone may occasionally modify this Data Protection Notice as our practices in this area evolve. If we make changes, we will notify you of such changes by changing the date at the end of this Privacy Notice, and in some cases we may provide you with a more prominent notice. We encourage you to periodically review this Privacy Notice to stay informed about how Danone is protecting your personal information.

This Data Protection Notice was last updated in November 2020.