Recruitment Privacy Statement

Who Are We?

Dana Petroleum Limited, or one of its subsidiaries, will run recruitment processes. Each of these entities are responsible for deciding how it holds and uses personal information about you depending on which entity is offering the role.

References in this Recruitment Privacy Statement (the “Statement”) to “We” or “Us” will be dependent on which entity is offering the position and each are separate “data controllers”.

This Statement is intended to cover the personal data processed by the whole of the Dana group, which covers a number of jurisdictions. For the avoidance of doubt the local applicable data processing rules will always apply to any personal data processed by Us within the relevant jurisdiction. As a result some aspects of this Statement will only apply to the applicable jurisdiction.

Background to this Statement

This Statement sets out the basis on which any personal data which We collect from you, or which is provided to Us, may be processed by Us. Please read this Statement carefully to understand our practices regarding your personal data and how We will treat it. This Statement makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. It provides you with certain information that must be provided under the General Data Protection Regulation ((EU) 2016/679) (“EU GDPR”), the UK GDPR (as defined in the Data Protection Act 2018) (“UK GDPR”), Data Protection Act 2018, Uitvoeringswet Algemene Verordening Gegevensbeschermin, Egypt Law No. 151 of 2020 Promulgating the Personal Data Protection Law, and any other laws relating to the processing, privacy and use of personal data as applicable to the relevant jurisdiction (together “Data Protection Laws”).

The Information We Hold About You

In connection with your application for work with Us, We may where required and as applicable in the relevant jurisdiction, collect, store, and use the following categories of personal information about you:

The information which you provide to Us (or where applicable provided to a third party recruiter) in your initial application, during an interview or during the application process
Any information provided to Us by your named referees
Any information relating to certifications including medical and offshore certificates
Any information collected from third-party background check providers and disclosure check agencies, where applicable

We may where required, and as applicable in the relevant jurisdiction, also collect, store and use the following “special categories” of more sensitive personal information:

Information about your race, nationality or ethnicity or your religious or other philosophical beliefs
Information about your health, information regarding any medical condition and any information provided to Us by our occupational health providers in the event that the nature of the role for which you are applying means that a medical examination is required

As required and where applicable in the relevant jurisdiction We may use the personal information We collect about you to:

Assess your skills, qualifications and suitability for the role
Carry out background and reference checks
Communicate with you about the recruitment process
Keep records related to the recruitment process
Comply with legal or regulatory requirements and deal with any disputes that may arise
In the case of the information about your race, nationality or ethnicity, sexual orientation, or your religious or other philosophical beliefs, to ensure meaningful equal opportunity monitoring and reporting
In the case of information about your health, in order to assess your working capacity on health grounds. We may also use any information about disability status to consider whether We need to make appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview

We consider that it is in our legitimate interests to collect and process the applicable information referred to above in order to decide whether to appoint you to a role within Our business. We also require to process the information to decide whether to enter into a contract with you and, if an offer is made, to decide upon the terms of any offer which is made.

If You Fail to Provide Personal Information

If you fail to provide information which is requested, and which is necessary for Us to consider your application (such as evidence of your qualifications or work history), We will not be able to process your application successfully. For example, if We require references for the role and you fail to provide Us with relevant details, We will not be able to take your application further.

Automated Decision Making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision making.

Data Sharing – Subsidiary Companies of Dana Petroleum Limited

We may require to share your personal information with subsidiary companies of Dana Petroleum Limited for the purposes of processing your application. In the event that your personal information requires to be transferred outside the United Kingdom and European Economic Area (“EEA”) or to a country who is not deemed “adequate”, We will ensure that appropriate technical and organisational safeguards are in place in accordance with relevant Data Protection Laws, or that a specific derogation applies. If you require any further information in this regard, please contact Our General Counsel & Company Secretary at the following email address – [email protected].

Data Sharing – Third Parties

We may require to share your personal information with Our occupational health providers for the purposes of processing your application, in the event that the nature of the role for which you are applying means that a medical examination is required. We may also share your personal information with third-party recruitment agencies and related service providers to support Us in processing applications for the role or similar roles. All of our third-party service providers are required to take appropriate security measures to protect your personal information in line with Our policies. We only permit our third party service providers to process your personal data for specified purposes and in accordance with Our instructions.

Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, We limit access to your personal information to those employees, agents, contractors and other third parties who require access to the information for legitimate business purposes. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and the applicable privacy regulator of a suspected breach where We are legally required to do so under applicable Data Protection Laws.

Data Retention – How Long Will Your Information be Used for?

In the event that your application is not successful, We will retain your personal information for a limited period, in line with the applicable Data Protection Laws and Our policies after We have communicated to you Our decision not to appoint you to the role. If the position for which you are applying is based in the Netherlands, We will retain your personal information for a period of 4 weeks after We have communicated to you Our decision not to appoint you to the role, in order to comply with the guidance of the Dutch Data Protection Authority.

We retain your personal information for those periods so that We can show, in the event of a legal claim, that We have not discriminated against candidates on prohibited grounds and that We have conducted the recruitment exercise in a fair and transparent way. After the applicable period has expired, We will securely delete or destroy your personal information in accordance with Our policies in place for retention.

If We wish to retain your personal information on file for a longer period for the purposes of future job opportunities, We will write to you separately seeking your explicit consent to retain your personal information on that basis. If the position for which you are applying is based in the Netherlands, the maximum period for which We will retain your personal information with your consent for such purposes shall be 1 year, in compliance with the guidance of the Dutch Data Protection Authority.

In the event that your application is successful, and you commence the role with Us, you will be provided with access to our Data Protection Policy, and any personal data will be processed in accordance with the terms of the Data Protection Policy.

Your Rights in Connection With Personal Information

Where applicable under the relevant Data Protection Law, you may have the following rights in connection with your personal data, which can be exercised at any time:

Right of access: you can request a copy of the personal information We hold about you and check We are processing it lawfully
Right to rectification: you can request that any incomplete or inaccurate information We hold about you is corrected
Right to erasure: you can request that We delete your personal information where there is no good reason for Us to continue to process it. You must provide valid reasoning for your request. This can be exercised in conjunction with the right to object (see below)
Right to object: you can object to Our processing of your personal information where We are processing on the basis of Our ‘legitimate interest’ or that of a third party. We shall cease processing your personal data unless there are compelling and legitimate grounds for processing which override your interests
Right to restrict processing: you can request that We restrict Our processing of your personal information. Information will be retained but not further processed
Right to data portability: where processing of personal data is carried out by automated means, you can request the transfer of your personal information to another party
Right to withdraw consent: where We are processing your personal data on the basis of consent, you have the right to withdraw your consent at any time
Right to not be subject to decision making based on automated processing: you shall have the right to not be subject to decision making based solely on automated means including profiling
Right to complain: you may have a right to lodge a complaint with a Supervisory Authority, which is an independent public authority established in the United Kingdom and each EEA member state that applies the EU GDPR in accordance with the Data Protection Laws. The Supervisory Authority for data protection issues in the United Kingdom is the Information Commissioner’s Office. The Supervisory Authority for data protection issues in the Netherlands is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority)

If you would like to exercise any of your rights, please use the contact details listed below or, in the case of the right to complain, please contact the relevant Supervisory Authority. In the United Kingdom, the Information Commissioner’s Office can be contacted via its website – www.ico.org.uk. In the Netherlands, the Dutch Data Protection Authority can be contacted via its website – www.autoriteitpersoonsgegevens.nl.

Further Information

If you have any questions about this Statement or how We handle your personal information, please contact Our General Counsel & Company Secretary , Dana Petroleum Limited, King’s Close, 62 Huntly Street, Aberdeen AB10 1RS. The General Counsel & Company Secretary can also be contacted by email at [email protected].