Privacy Notice for Applicants

Last Updated: February 2, 2026

This Job Applicant Privacy Notice (“Notice”) describes how NewStore, along with its affiliates and subsidiaries worldwide (“NewStore”, “we”, “us” and “our”), collects, uses, and discloses information about individuals who apply for open positions at NewStore (“Job Applicants”). NewStore processes your information in accordance with applicable data protection laws, including the European General Data Protection Regulation (GDPR), the UK GDPR and UK Data Protection Act 2018 (where applicable), the German Federal Data Protection Act (BDSG), relevant US state privacy laws such as the California Consumer Privacy Act (CCPA), and other applicable local data protection and privacy laws.

NewStore is the data controller of your information in the EEA and UK. Please see the end of this Policy for our contact details. For applicants located outside the EEA and UK, NewStore will handle your information in accordance with applicable local data protection and privacy laws.

We may also provide you with additional privacy notices regarding our collection, use or disclosure of information. Please read this Policy and any other privacy notices carefully. Please note that this Policy does not form part of any employment contract or contract to provide services.

We may update this Notice from time to time, for example if we implement new systems or processes that involve the use of personal data. We will inform you in an appropriate manner when we make material changes to this Policy.

This Notice does not apply to our handling of data gathered about you in your role as a user of the NewStore’s services. When you interact with us as in that role, the Privacy Policy associated with the relevant service applies.

Categories of Personal Data NewStore Collects and Handles

We collect, store, and use various types of personal data (i.e., information that identifies, relates to, or could reasonably be linked to you) in connection with your application for employment with us. We collect such information either directly from you or (where applicable) from another person or entity, such as professional networking websites, job posting websites, employment agencies, recruitment companies, or others who provide references. We may collect additional personal data throughout the course of your application process.

The information we collect from and about Job Applicants includes, where applicable:

• • Identifiers such as full name and alias; home and business addresses, telephone numbers, and email addresses; and, if you are provided an offer, identifiers related to your citizenship documents, such as driver’s license or passport number.
  • Professional or employment-related information, including:
    • Recruitment, employment, or engagement information such as application forms and information included in a resume, cover letter, or otherwise provided through the application and recruitment process; citizenship and/or immigration status; our evaluations of your performance during the interview process; and, if you are provided an offer, background screening results (including any criminal convictions, where permitted by law), citizenship documents, and references.
    • Career information such as job titles; work history; salaries; work dates and work locations; information about skills, qualifications, experience, publications, speaking engagements; and professional memberships.
    • Expense information such as expenses incurred during the interview process.
    • Other information that you may voluntarily choose to include on your resume or in connection with your application, a survey, or otherwise.

• Education information such as institutions attended, degrees, academic record, licenses, and professional memberships.
• Audio or visual information such as CCTV footage, as well as other information relating to the security of our premises collected during in-person interviews or other parts of the recruitment process; and video or audio recordings of the interview process.
• Internet and electronic network, and device activity and device information and related identifiers, such as information about your use of our network while you are on NewStore premises, including IP address and device identifiers and attributes.
• Health-related information, only as necessary to provide necessary accommodations at your request during the recruitment process and otherwise in accordance with applicable law.
• Other information that directly or indirectly identifies you, such as date and place of birth, citizenship, and permanent residence.

We may also collect, store, and use various types of information during your engagement or employment with us. In most cases, we collect such information directly from you. At times or where applicable, NewStore may also receive personal data from another person or entity, such as an employment agency or consultancy, background check provider (where permitted, such as in the United States), a prior employer or other referral sources, or professional websites such as LinkedIn.

We only collect sensitive personal data (also known as special category data in jurisdictions such as the European Economic Area (“EEA”) or UK) where you provide it voluntarily on your resume or in your application, or as needed to confirm your identity or immigration status, to comply with legal obligations, or to provide accommodations you request. We do not use any such sensitive information for purposes other than processing your application for employment, evaluating your candidacy, complying with legal obligations, or providing requested accommodations, in each case in accordance with applicable law.

Why Does NewStore Need to Collect and Process My Personal Data?

We may collect, use, disclose, and store personal data for our business purposes, which include, where applicable:

• Engaging in the recruitment process, including communicating with you, reviewing your application, interviewing, assessing your suitability, and selecting and hiring new personnel.
• HR management and administration, including determining compensation, scheduling, workforce planning, IT and informational security purposes, and conducting internal analyses and audits.
• Security operations, including detecting security incidents, debugging and repairing errors, and preventing unauthorized access to our computer and electronic communications systems and preventing malicious software distribution; monitoring and controlling access to company premises and locations (including through use of CCTV, where permitted by law); and safeguarding NewStore and its locations, services, and employees.
• Legal compliance, such as complying with applicable laws, regulations, and legal obligations, and responding to and cooperating with legal or regulatory requests and investigations.
• Exercising and defending our legal rights, including seeking legal advice from our external lawyers or in connection with litigation with a third party.

We may also use personal data for any other legally permitted purpose (subject to your consent, where legally required).

Some jurisdictions require us to inform you of the “legal bases” on which we process your personal data. We process your personal data for the following legal bases:

• Our legitimate business interests, such as where we need to process personal data for recruitment, security (e.g., operation of video cameras, access controls, locks), and administrative purposes, provided that such interests are not overridden by your interests or fundamental rights and freedoms.
• Taking steps at your request prior to entering into a contract, for example processing the data you provide to evaluate your professional suitability and to contact you in connection with your application, and to establish an employment relationship within the scope of pre-contractual measures.
• Compliance with legal obligations, where applicable laws require us to process personal data for certain purposes, such as tax and accounting requirements in connection with reimbursement of your travel expenses, or equal opportunity and immigration laws.
• Your consent, where legally required or permitted for certain personal data processing activities. When we rely on consent, you may withdraw your consent at any time as described below, without affecting the lawfulness of processing based on consent before its withdrawal.

With Whom Might NewStore Share Personal Data?

We may disclose certain personal data to the following types of entities or in the following circumstances (where applicable):

• Internally: to employees within NewStore that participate in or support the recruitment process, such as HR personnel, hiring managers, and employee interviewers, and to other personnel who have a legitimate business need to know the information.
• Vendors and service providers: such as background check companies, security providers, information technology providers, and employment businesses (e.g., recruiting contractors or agency workers) that provide us with services relevant to recruiting and hiring. Where required by law, we enter into appropriate data processing agreements with such vendors.
• Recruiters: to the extent you are working with a recruiter in connection with your application for employment and your recruiter is authorized by you to obtain feedback from us regarding your application and interview process.
• Legal compliance and exercising legal rights: when required to do so by law, regulation, or court order or in response to a request for assistance by the police or other law enforcement agency; and to seek legal advice from our external lawyers or in connection with litigation with a third party.
• Business transaction purposes: in connection with, or during negotiations of, any merger, sale, financing, acquisition, reorganization, or other transfer of all or a portion of NewStore’s business or assets.
• Consent: with your consent and as permitted by law, we may disclose personal data to any other parties and in other circumstances that we describe at the time we obtain your consent.

International Transfers

Some of the recipients we may share personal data with may be located in different jurisdictions. In some cases, this may include countries located outside the EEA and UK, including in jurisdictions that the EEA and UK have not recognized as providing an adequate level of protection. In those cases, we make the transfers in compliance with applicable law, typically by implementing appropriate safeguards, such as:

• Standard Contractual Clauses approved by the European Commission; and, where applicable
• The UK International Data Transfer Addendum or other UK-approved transfer mechanisms.

We may also rely on other transfer mechanisms where permitted by law, such as adequacy decisions or your explicit consent.

How Long Will NewStore Keep Personal Data For?

The personal data we collect from Job Applicants will be retained for as long as necessary to satisfy the purposes for which it was collected and our legal obligations. As described above, these purposes include our business operations and complying with reporting, legal and accounting obligations. In determining how long to retain information, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the personal data, the purposes for which we process the personal data and whether we can achieve those purposes in other ways, the applicable legal requirements, and our legitimate interests.

If your application is rejected, we will retain your application data for a limited period after notification of this decision, typically up to 24 months, unless a longer or shorter retention period is required or permitted by law, is necessary for the establishment, exercise, or defense of legal claims, or you have separately consented to a longer retention (for example, to be considered for future roles). If an employment relationship is established, your application documents will be stored at least for the duration of your employment and otherwise in accordance with our employee privacy notices and internal retention policies.

Your Rights

You may have a number of rights in relation to your personal data, depending on your jurisdiction. These rights are typically subject to important exceptions and limitations, but, where they apply, they can be summarized in broad terms as follows:

• Right of access. You may have the right to confirm with us whether your personal data is processed, and if it is, to request access to that personal data including the categories of personal data processed, the purposes of the processing and the recipients or categories of recipients, and other information about the processing. We must take into account the rights and freedoms of others, so this is not an absolute right, and in some cases permitted by law we may need to deny your request.
• Right to rectification. You may have the right to rectify inaccurate or incomplete personal data concerning you.
• Right to erasure. You may have the right to ask us to erase certain personal data concerning you, for example where the data is no longer necessary for the purposes for which it was collected or where you withdraw consent (if consent is the legal basis for processing) and there is no other legal basis for processing.
• Right to restriction of processing. In limited circumstances, you may have the right to request that we restrict processing of your personal data, for example while we verify the accuracy of your data or our legitimate interests.
• Right to data portability. For certain personal data you have provided to us, you may have a right to receive it in a commonly used and machine-readable format, and you may have the right to have the data transmitted to another entity, where technically feasible.
• Right to object and rights relating to automated decision-making. You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, including profiling, where we rely on our legitimate interests. In such cases, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims. Where we make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, you may have the right to request human intervention, to express your point of view, and to contest the decision, in accordance with applicable law.
• Right to withdraw consent. If we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Residents of certain jurisdictions, including some US states, may have additional or different rights under applicable privacy laws (for example, rights relating to access, deletion, correction, and opting out of certain processing activities, including certain profiling or automated decision-making). We will honor such rights in accordance with applicable law.

To exercise any of these rights, please contact us as described below. We will take reasonable steps to verify your identity before responding to a request, taking into account the nature of the request and the type of personal data involved. If we are unable to verify you through this method, we may request additional information from you as permitted by law. You also have the right to lodge a complaint with the competent data protection supervisory authority, which will depend on which country or region you are located in.

Note to California Residents

California law places certain obligations on businesses that “sell” personal data to third parties or “share” personal data with third parties for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (“CCPA”), as amended. We do not sell or share the personal data covered by this Policy and have not done so in the twelve months prior to the effective date of this Policy.

California law also provides the right to limit the use and disclosure of sensitive personal data if such data is used for certain purposes. We do not use your sensitive personal data for any purposes that would trigger a right to limit under California law.

Where California law grants job applicants additional rights (for example, regarding access, deletion, correction, or certain profiling or automated decision-making), we will honor those rights in accordance with applicable law.

How to Contact Us

For general questions about this Notice, please contact us at: privacy@newstore.com.

The controller in the sense of the GDPR is:

NewStore GmbH
Represented by its finance director Patrick Gruessing
Address: NewStore GmbH | Karl-Liebknecht-Str. 29A| 10178 Berlin
Phone: +491704742 214
E-mail: jobs@newstore.com

You can reach our external data protection officer at:

Data Protection Officer of NewStore GmbH
c/o activeMind AG
Management and Technology Consulting
Address: activeMind AG | Kurfürstendamm 56 | 10707 Berlin
Phone: 030 770191070
E-mail: datenschutz@newstore.com