1. What is the purpose of this document?
The purpose of this Global Job Applicant Privacy Notice is to affirm JMAN Group’s commitment to protecting the privacy and security of your personal data.

This Privacy Notice describes how we collect and use personal data about you during and after the recruitment process, in accordance with applicable data protection and privacy laws and regulations, including, where applicable, the UK General Data Protection Regulation (UK GDPR), as retained in UK law under the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, the Data (Use and Access Act) 2025, and the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended (the “UK Data Protection Legislation”); the India Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 issued under the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 (the “DPDPA”); and U.S. state privacy laws, such as the New York Civil Rights Law, and similar statutes.

It applies to all job applicants, including prospective employees, workers, contractors, secondees, and interns, applying for roles with any JMAN Group entity worldwide. JMAN Group refers collectively to JMAN Group Limited, JMAN US LLC, JMAN Digital Services Pvt Ltd, and any current or future affiliate or subsidiary entity of JMAN Group.
JMAN Group acts as a “data controller” for all personal data relating to job applicants (in India, the DPDPA refers to this role as the “data fiduciary”). This means that we are responsible for deciding how we hold and use personal data about you. We are required under applicable data protection legislation to notify you of the information contained in this Privacy Notice.

2. Data protection principles
JMAN Group adopts UK GDPR-aligned principles as JMAN’s baseline standard and complies with applicable data protection and privacy laws. Where local laws, regulatory requirements, or contractual obligations impose higher or additional standards, JMAN follows such requirements.

3. The kind of information we collect about you
• Your name, address and contact details, including email address and telephone number.
• Details of your qualifications, skills, experience and employment history.
• Information about your current level of remuneration, including benefit entitlements.
• Information about your entitlement to work in the relevant jurisdiction (e.g., right to work checks in the UK, employment eligibility verification in the U.S., or equivalent checks in India or other locations).
• Financial information (such as bank account details) in order to pay any reasonable travel or recruitment-related expenses, where applicable.
• Information generated through your interaction with our recruitment systems, including any AI-powered assessment tools or platforms, where used.

4. Special categories of personal data
We may also collect, store, and use the following “special categories” of more sensitive personal data, where lawful and appropriate in the relevant jurisdiction:
• Information about your race or ethnicity, religious beliefs, sexual orientation, and political opinions. We only collect this information where it is lawful to do so in the relevant jurisdiction, and where provided, it is done so on a voluntary basis for equal opportunities monitoring purposes only.
• Information about your health, including any disability for which we may need to make reasonable adjustments during the recruitment process.
• Information about criminal convictions and records (see below).

5. How is information collected?
JMAN Group collects your personal information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.
JMAN Group will also collect personal data about you from third parties, such as references supplied by former employers, information from criminal records and/or background checks, where applicable and permitted by law (for example, through the Disclosure and Barring Service in the UK, or equivalent background screening providers in the U.S. or India). JMAN Group will generally seek information from third parties only once a conditional job offer has been made and will inform you that it is doing so.
Your personal data will be stored in a range of systems, including our applicant tracking system, HR management systems, and other IT systems (including email).

6. How we will use information about you
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances, which UK Data Protection Legislation and other applicable data protection laws refer to as a ‘lawful basis’.
JMAN Group needs to process data to take steps at your request prior to entering into a contract with you. It also needs to process your data to enter into a contract with you.

In some cases, JMAN Group needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant’s eligibility to work in the UK before employment starts.

JMAN Group has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows JMAN Group to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. JMAN Group may also need to process data from job applicants to respond to and defend against legal claims.

Where JMAN Group relies on legitimate interests as a reason for processing data, it has considered whether or not those interests are overridden by the rights and freedoms of job applicants and has concluded that they are not.

JMAN Group processes health information if it needs to make reasonable adjustments to the recruitment process for candidates who have a disability. This is to carry out its obligations and exercise specific rights in relation to employment.

Where JMAN Group processes other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes in the relevant jurisdictions.

We will only process information relating to criminal offences, allegations, or convictions data where this is permitted by applicable law and subject to appropriate safeguards. We will only request or collect criminal conviction data where it is appropriate given the nature of the role, the level of responsibility involved, and the associated legal or regulatory requirements, and only to the extent that we are legally entitled to do so. In New York, we comply with applicable fair chance hiring laws, including restrictions on the timing and use of criminal background checks in employment decisions.
If your application is unsuccessful, we will retain your personal data for up to two (2) years after the end of the relevant recruitment process, on the basis of our legitimate interest in considering you for future employment opportunities and in managing and defending against potential legal claims. If you would like us to delete your personal data sooner, you may contact us at any time at dataprotection@jmangroup.com and we will process your request in accordance with applicable law.

If your application is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in JMAN Group’s Employee Privacy Notice

7. Data sharing
Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

We may share your personal data with other entities within the JMAN Group, such as JMAN Group Limited, JMAN US LLC, and JMAN Digital Services Pvt Ltd, where necessary to manage the recruitment process. If your application for employment is successful and JMAN Group makes you an offer of employment, then they will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service (UK) or equivalent background screening providers in other jurisdictions, to obtain necessary criminal records or background checks, where applicable and permitted by law.

8. Transferring information outside the UK, India, or the U.S.
We may transfer your personal data outside the UK, India, or the United States, including to other entities within the JMAN Group or to third-party service providers that support our recruitment process.

Where your personal data is transferred internationally, we take appropriate steps to ensure that it continues to receive an adequate and consistent level of protection, in line with UK Data Protection Legislation and other applicable data protection and privacy laws.
When your personal data is transferred to another JMAN Group entity, JMAN relies on its Intragroup Data Transfer Framework (IDTF). This framework incorporates the use of appropriate safeguards and approved transfer mechanisms, as required by applicable data protection laws (for example, standard contractual clauses or equivalent mechanisms), to ensure your personal data is protected.

When your personal data is transferred to third-party service providers located outside the UK, India, or the U.S., we ensure that appropriate safeguards are in place, including the use of contractual protections such as approved data transfer clauses.

9. Data security
JMAN Group takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.
We have put in place appropriate technical and organisational measures to protect the security of your personal data. Access to your personal data is limited to those employees, agents, contractors, and other third parties who have a legitimate business need to know. All such persons are subject to a duty of confidentiality.

We have procedures in place to address any suspected personal data security breach and will notify you and any relevant supervisory authority where we are legally required to do so.

10. Data retention
We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of complying with any legal, regulatory, accounting, or reporting requirements.

If your application is unsuccessful, we will retain your personal data for up to two (2) years after the end of the relevant recruitment process, on the basis of our legitimate interest in considering you for future employment opportunities and in managing and defending against potential legal claims. At the end of that period, your data will be securely deleted or destroyed in accordance with our retention policy.

If you would like us to delete your personal data sooner, you may contact us at any time at dataprotection@jmangroup.com and we will process your request in accordance with applicable law.

If your application is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in JMAN Group’s Employee Privacy Notice.

11. Your rights in connection with personal data
Depending on applicable data protection and privacy laws, you may have the right to:
• Request access to your personal data (commonly known as a “data subject access request”), to receive a copy of the personal data we hold about you and to understand how it is processed.
• Request correction or rectification of inaccurate or incomplete personal data that we hold about you.
• Request erasure of your personal data where there is no lawful reason for us to continue processing it.
• Request restriction or suspension of processing of your personal data in certain circumstances.
• Object to our processing of your personal data where we rely on legitimate interest.
• Request the transfer of your personal data to another party, where this right applies under applicable law.
• Withdraw your consent, where we rely on consent as the lawful basis for processing.
• Raise a grievance or complaint regarding our handling of your personal data.
• In certain jurisdictions, nominate another individual to exercise rights on your behalf.

11.1 How to exercise your rights
If you would like to exercise any of these rights or make a subject access request, you may contact JMAN’s Data Protection & Privacy Team at dataprotection@jmangroup.com.

11.2 No fee usually required
You will not normally have to pay a fee to exercise your data protection rights. However, we may charge a reasonable fee, or refuse to comply with a request, where it is manifestly unfounded or excessive, as permitted by law.

11.3 Verification of identity
We may need to request additional information from you to confirm your identity before responding to a request. This is a security measure to ensure that personal data is not disclosed to an unauthorised person.

11.4 Complaints and escalation
If you have questions, concerns, or would like to escalate a matter relating to this Privacy Notice or our handling of your personal data, you may contact JMAN’s Data Protection & Privacy team at dataprotection@jmangroup.com.
JMAN also has an externally appointed Data Protection Officer (“DPO”), which is HewardMills Ltd. If you would like to escalate concerns about any of the rights above, this Privacy Notice, or how we handle your personal data, you may contact JMAN’s DPO at jman@hewardmills.com.
You also have the right to lodge a complaint with the relevant data protection or supervisory authority in your jurisdiction. For example, the Information Commissioner’s Office (ICO) in the UK. Other supervisory authorities may also be competent depending on your location.

12. What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to JMAN Group during the recruitment process. However, if you do not provide the information, JMAN Group may not be able to process your application properly or at all.

13. Automated decision making
Automated decision-making (“ADM”) refers to a decision about an individual that is made entirely by automated means, without meaningful human involvement, and which produces legal effects or significantly affects an individual.
As a general principle, JMAN Group does not make decisions about job applicants that have legal or similarly significant effects based solely on automated processing without meaningful human involvement. Decisions relating to recruitment are taken with human judgment and oversight.
If this position changes, and we were to introduce any form of ADM or AI-powered assessment tool that is subject to legal requirements, we would inform you in advance, ensure that appropriate safeguards are implemented in accordance with applicable law, and where required (such as under New York City law), commission an independent bias audit of any such tool.

14. Changes to this Privacy Notice
We may update this Privacy Notice from time to time. The latest version will always be available on our careers page (or equivalent channel where this Privacy Notice was made available to you), with the date of the most recent update clearly indicated. Where required by applicable law, we will take additional steps to bring material changes to your attention.