Candidate Privacy Notice | Green SM

The controller of your personal data is: Green and Smart Mobility Netherlands B.V. (“Green SM”), registered at Basisweg 32, 1043 AP Amsterdam, The Netherlands, KvK 99996901. For any questions regarding this Privacy Notice or your personal data, please contact us at: eu.privacy@greensm.com If you live in the EEA, you may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, “AP”), Postbus 93374, 2509 AJ Den Haag, www.autoriteitpersoonsgegevens.nl, or with another competent supervisory authority in the EEA where you live or work.

This Privacy Notice explains how Green SM collects, uses, stores, shares, transfers and otherwise processes the personal data of individuals who apply for, are considered for, or express an interest in working with Green SM, whether as an employee, independent contractor or under another engagement, in the Netherlands ("Candidates"). Throughout this Privacy Notice, such personal data is referred to as "Candidate Data". It applies to: • driver candidates; • office, operations, dispatch, customer support, fleet, depot, HR, finance, legal, IT, marketing, management and other non-driver candidates; • candidates introduced through agencies, referrals, job boards, direct sourcing, recruitment events or the Green SM careers page; • candidates for full-time, part-time, fixed-term, on-call or temporary roles; • people who consent to remain in a Green SM talent pool.

Green SM collects Candidate Data progressively throughout the recruitment process and only to the extent necessary for the relevant recruitment stage. We apply the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, as set out in Art. 5 GDPR. 3.1 Data we may collect from all candidates • name and contact details (postal address, e-mail, telephone); • city, country and language preference where relevant; • role applied for or role interest; • CV / résumé, cover letter, portfolio, certificates, education and work history; • application source (career page, job board, agency, referral, event); • availability, expected start date and work-location preference; • job-related qualifications, skills, experience and interview answers; • interview notes, assessment results and hiring-manager feedback; • communication history with Green SM recruiters, HR, hiring managers and agencies; • offer details, acceptance or rejection status and relevant decision reasons; • right-to-work indication needed to assess whether Green SM may employ you in the Netherlands under the Wet arbeid vreemdelingen. 3.2 Additional data for driver candidates For driver candidates, Green SM may also process: • confirmation of minimum legal age for the driver role; • Category B driving licence status, issuing country and validity. Green SM collects the licence number or copy only after a conditional offer has been accepted, or where strictly necessary to verify compliance with applicable legal or regulatory requirements. Where possible, Green SM records only the outcome of the verification rather than retaining a copy of the driving licence, in accordance with the guidance of the Autoriteit Persoonsgegevens on copying identity; • chauffeursdiploma / CCV taxi exam status, where relevant; • chauffeurskaart status and related Kiwa Register authorisation information under the Wet personenvervoer 2000; • professional driving experience; • customer-service experience; • lawful shift availability; • depot / location preference where relevant; • language ability relevant to passenger service; • internal driving, EV-handling, app-use, navigation and service-quality assessment results; • training and onboarding completion status; • vehicle-handover readiness once employment and licensing conditions are met. 3.3 Additional data for non-driver candidates For non-driver candidates, Green SM may also process: • professional licences or certifications relevant to the role; • technical, operational, managerial, legal, financial, HR, IT, marketing, fleet, depot, customer-support or dispatch skills; • role-specific assignments, work samples or case-study results; • language ability where relevant to the role; • information needed to assess seniority, reporting line, role fit and business need. 3.4 Data collected only after conditional offer, engagement or hiring (where applicable) Green SM normally collects the following only after a conditional offer has been accepted, a commercial engagement has been agreed, or where legally required during onboarding, and only to the extent applicable to the relevant relationship: • BSN (burgerservicenummer), only where and to the extent a statutory provision requires it (Art. 46 UAVG), for payroll, tax and social-security purposes; • bank account / IBAN; • payroll and tax information; • copy of passport, ID card, residence permit or work-authorisation document, taken only once employment starts, where required under the Wet op de identificatieplicht and Art. 28 Wet op de loonbelasting 1964 for identity verification and payroll compliance; • pension and benefits information; • KvK registration, VAT number (where applicable), and other business registration details (independent contractors / ZZP only); • emergency contact information (if required by Green SM HR policy); • signed employment documents and onboarding records.

Green SM does not ask candidates to provide: • health or medical details; • pregnancy or family-planning information; • marital status, family status or childcare arrangements (unless a later statutory benefits or pension process specifically requires it); • racial or ethnic origin; • religion or belief; • political opinions; • trade-union membership; • sexual orientation or sex life; • biometric data used to identify you; • criminal-offence data, other than a Verklaring Omtrent het Gedrag (VOG) where the role requires one and only in line with Art. 10 UAVG; • prior deactivation from third-party ride-hailing platforms (Uber, Bolt, FreeNow, etc.). We assess you on your own merits. If you need an adjustment to participate in the recruitment process (for example, accessibility support, alternative interview format), Green SM may process the limited information needed to arrange that adjustment. This information will be kept confidential, processed separately from your application file, and will not be used to assess your suitability except where strictly necessary. If you voluntarily provide information that Green SM did not ask for and does not need, Green SM will not use it for the recruitment decision and may delete it.

We collect most Candidate Data directly from you. We may also receive data from: • recruitment agencies, staffing providers or payroll providers; • job boards and professional platforms; • employee referrals (referrer should let you know); • recruitment events and job fairs; • references you provide or authorise us to contact (Green SM will contact references only after informing you and obtaining your prior consent. References are contacted only where relevant to the position applied for and only after interviews or at the conditional offer stage); • public professional sources (such as LinkedIn) where relevant and proportionate — we do not systematically screen private accounts and will tell you if a specific public source has influenced our assessment; • licensing, right-to-work or regulatory sources where needed for driver or employment compliance; • assessment providers or background-screening providers, only where lawful and pre-approved. If you provide a reference's contact details, you should inform that person that Green SM may contact them for recruitment purposes.

Purpose	Examples	Legal basis (GDPR / UAVG)
Manage applications	Receive applications, track status, schedule interviews, communicate with candidates.	Art. 6(1)(b) pre-contractual measures; Art. 6(1)(f) legitimate interests in recruitment administration.
Assess suitability	Review CVs, qualifications, interview answers, assessments, role fit; compare candidates; take hiring decisions.	Art. 6(1)(b); Art. 6(1)(f) selecting suitable candidates.
Driver licensing readiness	Verify Category B licence, chauffeurskaart status, taxi-licensing readiness, statutory readiness before any paid passenger service.	Art. 6(1)(c); Art. 6(1)(b); Art. 6(1)(f) safe and lawful taxi operations.
Right-to-work checks	Verify whether Green SM may lawfully employ you in the Netherlands.	Art. 6(1)(c); Art. 6(1)(b).
Reasonable accommodation	Limited adjustment-related data to enable participation in the process.	Art. 9(2)(b)
Prepare an offer	Draft offer letters, employment contracts, compensation and start-date arrangements.	Art. 6(1)(b); Art. 6(1)(f).
Onboard hired candidates	Payroll, tax, pension, HR records, IT access, training, system activation.	Art. 6(1)(b) employment contract; Art. 6(1)(c) tax/social-security/immigration; Art. 6(1)(f) secure onboarding.
Talent pool	Consider you for future roles.	Art. 6(1)(a) consent — separate, informed, freely given (unticked-by-default opt-in; withdrawable at any time).
Improve recruitment	Measure channel effectiveness, time-to-hire and process quality, normally in aggregated / pseudonymised form.	Art. 6(1)(f).
Security and fraud prevention	Protect systems; detect false applications.	Art. 6(1)(f); Art. 6(1)(c) where applicable.
Legal compliance and claims	Audit, authority requests, disputes, defence of legal claims.	Art. 6(1)(c); Art. 6(1)(f) establishing/exercising/defending legal claims.

Where Green SM relies on legitimate interests, Green SM balances its interests against candidate rights and reasonable expectations and documents the balancing test. You may object on grounds relating to your particular situation. Where Green SM relies on consent, you may withdraw consent at any time. Withdrawal does not affect processing carried out before withdrawal.

Green SM verifies candidate information only where relevant and proportionate and applies the NVP Sollicitatiecode (the Dutch recruitment code) alongside the rules set out below. • References are contacted only with your prior consent, normally at or around the offer stage, and only on job-related matters. • Background checks are carried out only where objectively necessary for the relevant position, are proportionate to the role, and comply with applicable Dutch law. • Credit checks are not part of standard recruitment unless legally required for a specific role. • Social media: we do not systematically screen private accounts; we may consult public professional profiles where directly relevant, and we will tell you if a specific source has influenced our assessment. • No covert checks: Green SM does not carry out covert surveillance, undercover online screening or false-identity contact with candidates.

Green SM may use recruitment systems to manage applications and workflow. Green SM does not make recruitment decisions based solely on automated processing where the decision produces legal effects or similarly significantly affects you (Art. 22(1) GDPR). If Green SM uses AI-assisted recruitment tools (such as ranking, matching, scoring or recommendation features) these tools will be used only to support human recruiters and hiring managers. All shortlisting, interview and hiring decisions are subject to meaningful human review, and no Candidate will be accepted or rejected solely on the basis of automated processing. Green SM does not use facial-expression analysis, voice-emotion analysis, biometric identification, personality inference from video/voice, or solely-automated rejection in recruitment.

Green SM may contact candidates who apply, sign up through a Green SM form, meet Green SM at a recruitment event, are referred, or otherwise request recruitment contact. Bulk WhatsApp, SMS, e-mail or direct-message recruitment is allowed where: • the candidate has specifically consented to recruitment messages through that channel (separate, freely-given, informed and unambiguous consent under Art. 4(11) GDPR); • Green SM identifies itself in every message; • the message explains the purpose; • there is an easy opt-out in every message; • Green SM can evidence the consent and the opt-out. Green SM does not use bought, scraped or unverified contact lists for recruitment outreach.

Green SM shares Candidate Data only with parties that need it for recruitment, onboarding, compliance, security or legal purposes. Recipients may include: • Green SM recruiters, HR, hiring managers, interviewers and operational managers (need-to-know); • Green SM group entities and group support functions, including entities outside the EEA where relevant, where access is necessary for recruitment approval, IT support, reporting or governance; • recruitment agencies, staffing providers, payroll providers, accounting providers, assessment providers and background-screening providers (where lawfully engaged); • ATS, HRIS, CRM, cloud, e-mail, document-management and security providers; • video-conferencing providers used for interviews; • taxi-licensing and public authorities where required by law; • competent authorities, courts or regulators (including the AP) where required by law. Green SM does not sell Candidate Data and does not share Candidate Data with third parties for their own marketing. Processors operate under written agreements meeting Art. 28 GDPR. Where joint controllership exists, Green SM concludes an Art. 26 arrangement.

Some Green SM group entities and service providers are located outside the European Economic Area. Where Candidate Data is transferred or remotely accessed outside the EEA to a country that has not received an EU adequacy decision, Green SM applies appropriate safeguards under Chapter V GDPR, in particular: • the 2021 EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), which Green SM uses as its standing transfer mechanism for intra-group and vendor transfers; • a documented Transfer Impact Assessment (TIA) and supplementary technical, contractual and organisational measures where required. Access by group entities outside the EEA is limited strictly to need-to-know users for defined recruitment, IT-support, governance, security and legal-compliance purposes, and is protected by contractual, technical and organisational measures. You may obtain a copy of the relevant safeguards (with commercially sensitive information redacted) by contacting eu.privacy@greensm.com.

Data category	Retention period
Active application	For the duration of the recruitment process.
Rejected or withdrawn candidates (default)	4 weeks after the end of the procedure, in line with Autoriteit Persoonsgegevens guidance.
Talent pool with separate, informed, freely given consent	Up to 1 year after the end of the procedure, then deleted unless consent is actively renewed. Consent is not tacitly extended.
Recruitment-event leads	4 weeks after the campaign closes, or up to 1 year with separate, informed, freely given recruitment-follow-up consent, renewed actively at the end of that year.
VOG (where collected)	Destroyed promptly after verification; only date and fact of verification retained.
Hired candidates	Data migrates to the personnel file under the Employee Privacy Notice; recruitment-specific data is purged per the schedule above.
Records needed to defend against claims	Up to 2 years, or longer where a specific claim or audit requires.
Assessment materials	Only as long as needed to evaluate the application and handle complaint or challenge periods.
Legal hold / audit / investigation data	As long as necessary for the legal hold, audit, authority request, dispute or claim, with a review date.

When retention expires, Green SM deletes or anonymises the data.

Green SM implements appropriate technical and organisational measures designed to protect Candidate Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, in accordance with Article 32 GDPR, including: • role-based access controls; • confidentiality obligations on all personnel and vendors; • encryption in transit and, where appropriate, at rest; • secure cloud hosting and logging; • vendor due diligence and DPAs; • retention and deletion controls; • incident response and breach escalation; • security training for personnel handling recruitment data. Candidate Data must not be stored in personal inboxes, private devices, unmanaged messaging apps or informal spreadsheets unless approved controls are in place.

You have the following rights under GDPR, exercisable free of charge: • access your personal data and obtain a copy; • rectification of inaccurate or incomplete data; • erasure ("right to be forgotten") where one of the GDPR grounds applies; • restriction of processing in certain situations; • object to processing based on legitimate interests, including profiling; • data portability for data you have provided to us, where technically feasible; • withdraw consent at any time; • request information regarding the safeguards applied to international transfers of your personal data under Chapter V GDPR; • lodge a complaint with the AP or another competent EEA supervisory authority. To exercise your rights, contact eu.privacy@greensm.com. Green SM may ask for reasonable information to verify your identity. We will respond within one (1) month of a verifiable request, extendable by two (2) months for complex requests in line with Art. 12(3) GDPR. You will not be discriminated against or retaliated for exercising your rights. In some cases, deletion, objection or withdrawal of consent may affect Green SM's ability to continue considering you for a role; Green SM will explain that consequence to you.