Privacy Policy Netherlands (EN)

CANDIDATE DATA PRIVACY STATEMENT FOR THE NETHERLANDS

1. Introduction
This is the Privacy Statement of ViX Communications B.V. (hereinafter: "Company", "we" or "us"). We respect

your privacy and are committed to protecting your personal data.

This Privacy Statement describes how we handle your personal data as a data controller in compliance with the EU General Data Protection Regulation 2016/679 (hereinafter: "GDPR") and other relevant data protection laws as may be applicable.

This Privacy Statement was last updated on November 30, 2022, and may be updated from time to time to reflect changes in the way we process personal data. We will actively notify you about changes to this statement or the way we use your personal data when we are legally required to do so.

In this Privacy Statement we explain:

• When this statement applies to you
• Why we process your personal data, the legal basis thereof and the personal data we collect Who we share your personal data with
• How long we retain your personal data
• Your statutory right as data subject
• Security and protection of your personal data
• How to contact us

2. When this statement applies to you
This Privacy Statement applies to the processing of personal data we collect from you during your application process.

3. Why we process your personal data, the legal basis thereof and the personal data we collect

To process your job application

We process your personal data when you apply for a job at the Company. We process your personal data for this purpose on the basis of article 6.1 (b) GDPR (performance of a contract, including pre-contractual measures) and article 6.1 (f) GDPR (our legitimate interest of protecting our business), as applicable.

The personal data we process for this purpose includes your full name, date of birth, gender, contact details, and other information that is included in your curriculum vitae and cover letter.

We may request to provide personal data from former employers in order to get references about you. You, hereby, acknowledge that the referees you provide to the Company have been informed about and have agreed with the provision of their personal data by you to the Company. We will process the references provided by the referees as part of the necessary information related to you to applying for a certain position.

In addition, we may conduct a screening where we meet the statutory conditions, i.e. where we have a legitimate interest and the screening is necessary. We will inform you upfront before conducting any screening and will provide you with the outcome of the screening.

To contact you for future career opportunities

When the job application process is completed, we process your data for further career opportunities within the Company on the basis of article 6.1 (a) GDPR (consent). The personal data we process for this purpose include your full name, date of birth, gender, contact details, and other information following from your curriculum vitae and cover letter.

To make our website available and function

When you visit our website, we collect data about you automatically, using only strictly necessary cookies.

4. Who we share your personal data with

In accordance with this Privacy Statement, we may share your personal data only with those, including third parties, who are necessarily involved in the recruitment and selection process. In that respect, we may share your personal data with our international offices (that operate under the umbrella of TelevisaUnivision, Inc. or third parties that are located outside the EU/EEA. If your personal data is transferred outside the EU/EEA, we ensure that appropriate measures are taken and that your data is transferred in accordance with the GDPR.

5. How long we retain your personal data

We will only retain your personal data for as long as this is necessary in relation to the purpose for which your personal data is collected and otherwise processed. When we no longer need to process your personal data, we will delete your personal data from our systems and/or records or we will take steps to render your personal data anonymous, in which case you can no longer be identified. The Company will also take into account specific data retention obligations arising from applicable laws other than privacy laws, which may prohibit the deletion of data before expiry of the minimum retention period.

With respect to processing your job application specifically, we will retain your personal data for as long as four (4) weeks after the end of the application procedure, unless we are legally required and/or permitted to retain your personal data for a period thereafter. With your consent, we will retain your personal data for future career opportunities with a maximum of one (1) year.

6. Your statutory right as data subject

Under the GDPR you have certain rights in relation to your personal data, as further specified below. We will respect your statutory rights and comply with your request to the extent we are legally required to do so. Please be aware that not all statutory rights are absolute and that we may have legitimate grounds on the basis of which we can refuse your request.

If you would like to exercise any of your statutory rights, please contact us at the address, e-mail address or phone number as stated in the 'How to contact us' section below (section 8). We may ask you to provide documentation demonstrating your identity when you make a request. If you make a request we have one (1) month to respond. That period may be extended by two (2) further months if necessary, taking into account the complexity and number of requests.

Your statutory rights include:

• Right to access: You have the right to request information about how we process your personal data, including the categories of personal data we process, recipients of your personal data, and purposes for our processing. You also have the right to obtain a copy of the personal data undergoing processing. For further copies requested, we may charge a reasonable fee based on administrative costs.

• Right of rectification: You have the right to request that we correct incorrect personal data we hold about you. Depending on the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• Right of erasure (right to be forgotten): You have the right to request the deletion of personal data concerning you where: (a) the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) you withdraw your consent and there are no other legal grounds for the processing; (c) you exercise your right to object (see below) and there are no compelling legitimate grounds for the processing; (d) the personal data have been unlawfully processed; or (e) the personal data have to be erased for compliance with a legal obligation applicable to us.

• Right to restriction of processing: You have the right to request that we restrict the processing of your personal data (i.e., data will be blocked from normal processing but not erased) where: (a) you contest the accuracy of the personal data, for a period enabling us to verify the accuracy; (b) the processing is unlawful and you oppose the erasure of the personal data and requests the restriction of their use instead; (c) we no longer need the personal data for the purposes of the processing but they are required by you for the establishment, exercise or defence of legal claims; (d) you exercise your right to object (see below) pending the determination of whether our legitimate grounds override your rights.

• Right to withdraw your consent: Where processing is based on your consent, you have the right to withdraw consent at any time with future effect. Please note that withdrawing your consent is not affecting the lawfulness of processing based on consent before the withdrawal was made.

• Right to data portability: You have the right to request to receive your personal data in a structured, commonly used and machine-readable format, and to have the data transferred by us to another data controller unhindered, insofar as the processing is carried out on the basis of your consent or on the basis of a contract and the processing is carried out using an automated process.

• Right to object: You have the right to raise objections to the processing of your personal data that is based on our legitimate interest, including profiling, for reasons relating to your particular situation.

At any time, in addition to the rights set out above, you have the right to lodge a complaint in relation to the processing of your personal data with the Dutch Data Protection Authority ( Autoriteit Persoonsgegevens):

Postbus 93374
2509 AJ Den Haag
The Netherlands
Tel.: +31 (0) 88 1805 250)

7. Security and protection of your personal data

We are committed to protecting your personal data, and we have implemented appropriate technical and organizational measures to ensure the personal data we process is protected from unauthorized access, use, disclosure, alteration or destruction, in accordance with applicable laws and regulations.

8. How to contact us

The data controller with respect to the processing of personal data as described in this Privacy Statement is ViX Communications B.V. If you would like to exercise your statutory rights, withdraw your consent to the processing of your personal data, suspect misuse or loss of or unauthorised access to your personal data or have any questions regarding this Privacy Statement, you can contact us at: Privacy Officer, Amsterdam Zuid, Apollolaan 151,1077 AR, Amsterdam; and at privacy@univision.net.