Privacy Statement for Job Applicants

1. Introduction

Your personal data is in safe hands with us. As a potential job candidate, you must be secure in the knowledge that we do everything we can to protect your data. We comply with all the applicable laws and regulations, which may include but is not limited to the California Consumer Privacy Act (“CCPA”), the Personal Information and Electronic Documents Act (“PEPIDA”), Rabobank Privacy Code, and Federal Law on the Protection of Personal Data (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and its Regulations (Reglamento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares). This Privacy Statement for the Recruitment and Selection process (referred to below as the ‘R&S process’) explains how your data is processed.

If this Statement contradicts with any national, local or state legislation in the USA, Mexico or Canada, the latter legislation will supersede.

Rabo AgriFinance LLC, Coöperatieve Rabobank U.A., New York Branch, the U.S. and Mexico representative offices of Coöperatieve Rabobank U.A., Rabobank Canada, Rabo Support Services, Inc., Rabo Diversified Services LLC, Rabo Securities USA, Inc., or any other affiliated entities operating in North America, (hereinafter collectively and individually referred to as ”Rabobank”), is bound by the applicable rules regarding personal data processing.

1.2 What do we mean exactly by ‘personal data’ and the processing of this data?

• Personal data refers to data which relates to you personally, either directly or indirectly. This might include:

– Your name and address, date of birth, sex, telephone number and email address – Your resume and cover letter
– Links to your public profiles on websites such as LinkedIn
– A photograph and/or audiovisual job application video

• Processing refers to any activity involving personal data. When you apply for a job with us, we collect, use and retain your personal data. We do this, among other things, to verify that you hold the qualifications required for the position.

1.3 Whose personal data do we process, and how do we process it, during the job application process?

This Privacy Statement applies to all processing of the personal data of candidates and potential candidates as part of the R&S process at Rabobank. The data is processed in the HR system in The Netherlands, Europe by or on behalf of Rabobank. If you are hired by Rabobank, you will be subject to the Privacy Statement for Employees.

1.4 Who is responsible for processing my personal data?
Rabobank is responsible for processing all personal data processed.

Our contact details are:

Rabobank
14767 North Outer 40 Road Suite 400, Chesterfield, MO 63017, USA fm.am. WorkdaySupport@rabobank.com

1.5 How do we obtain your personal data?
We have two ways of acquiring your personal data:

• You provide this yourself or through a third party/third parties (either through referees or an external recruitment agency).
• We also collect data (including contact details) ourselves through resources such as a resume databases. We do this if we think you might be interested in working for Rabobank. If the recruiter contacts you, they will tell you where they found your details. In addition, they will ask you for permission to use these details to contact you regarding a job opening or event. You can change or revoke your consent at any time.

2. Principles and purposes of processing personal data relating to a job application

We process your data:
• based on your express consent – which can be revoked at any time;
• if we have a statutory obligation to do so;
• in order to enter into an employment contract with you and subsequently perform this contract; • based on a legitimate interest on our part.

2.1 For what purposes do we process personal data? We process personal data for the following purposes:

a. Human resources

We require your personal data in order to be able to properly conduct our R&S process. This includes assessing whether you are suitable for the position and whether we would like to invite you for an interview. Another reason might be to produce an access card, which you require in order to enter the building. Rabobank pursues a diversity policy because we want our employees to reflect the larger society.

b. Health, safety, security and ethics (including pre-employment screening)

Like all other financial institutions in North America, Rabobank subjects future employees to a background check. We are required by law to do so. Our screening procedures apply to all applicants who are potential employees. We attempt to ascertain as accurately as possible whether you, as an applicant to the bank, are sufficiently trustworthy. A positive outcome of the background check is a condition for getting hired. All applicants to be screened are subject to the same procedure, which consists of the following two stages:

• Stage 1: the original version of your highest qualification will be verified during the job interview.
• Stage 2: if we intend to enter into an employment contract with you, we will ask you to complete a statement; this statement advises you that we will be gathering information on you.

This includes the opinions of employers or clients you have had over the past two years regarding your trustworthiness. We may also use data for this purpose which we obtain from third parties, including former employers (through references we received from you) and recruitment agencies. We may also consult public sources during the job application process, including publicly accessible and professional social media (if this is relevant to the position and is specified in the job advert).

We also record personal data in order to protect the interests of our employees, visitors, the bank and the financial sector. We do this, among other things, through an internal camera security system.

c. Business reports and analysis and organizational development

We may process your data to create business reports, surveys and analyses. We may also merge the various data we possess on you, for example to improve the R&S reports (e.g. the number of job openings, number of applicants and the time it takes to fill these vacancies). The results of the analyses and the resulting recommendations can never be traced back to you.

d. Statutory requirements

We collect data relating to you based on specific domestic and international laws and regulations. Certain positions may require background checks to determine if you are qualified for the position and meet all regulatory requirements.

3. Do we also process special categories of personal data?

By ‘special categories of personal data’, we mean various types of sensitive data. This data may relate to a person’s health, veteran status, and data regarding race or ethnic background. If you ask us to record special categories of personal data relating to you or are disclosing this data yourself, we will only process this data if there is a clear purpose, there are grounds to do so, and this is necessary for the purpose. Special categories of personal data may also be processed, for example photographs or video recordings of you. This includes any pictures you might have enclosed with your resume, as well as camera footage recorded of you on entering the building. We process this camera footage solely for the protection of the property of Rabobank and our employees, and for other security reasons.

4. How do we handle your personal data?

Your personal data is used exclusively by employees who require access to this data on account of their position. The employees who are involved in your application process are bound by confidentiality. We only reuse data if the original data is related to the new purpose.

5. How do we deal with third parties?

Sometimes we engage the services of third parties, which process personal data on our behalf. This includes external recruitment agencies, background check agencies, and research companies. We can only engage third parties if this suits the purpose for which we processed your personal data and this is sufficiently reliable. Furthermore, we will only hire the services of such a third party or parties if they have implemented the appropriate security measures and guarantee confidentiality. If your application process includes an assessment, we will notify you in advance and will only save the report to your job application file once you have approved the accompanying report.

6. How long do you keep my details?

If you created an online profile with us, you will be able to use it again for other job applications at Rabobank in the future. If your job application was unsuccessful, we will delete your personal data within 24 months (USA), 12 months (Mexico), 60 months (Canada) of completing the application process. This includes all application details, e.g. your job application letter, and resume. You can log into your account on www.rabobank.jobs within that period and choose to delete your data. If you join Rabobank, our record retention policy applies to all personal data that we have of you.

7. What rights do you have in relation to your personal data?

7.1 Right of access
You can access your profile on www.rabobank.jobs at any time and view the data you have provided us. Or

you may ask us to view the data we have stored in relation to you (e.g. public online details and camera footage you won’t be able to access via the profile on www.rabobank.jobs)

7.2 Right of rectification
If your data is incorrect, incomplete or in violation of the law, you can change your data at any time on

www.rabobank.jobs. Or you can request us to have it rectified if you don’t have access to it through your profile on www.rabobank.jobs.

7.3 Right to be forgotten
You can delete the data recorded in relation to you if you object to this data being processed. This might be the case, for example, if the processing is unlawful or no longer necessary for the purposes for which it was collected. You can do so on www.rabobank.jobs. You may also request to have data deleted if you don’t have access to it through your profile on www.rabobank.jobs.

7.4 Right to restrict processing
If you wish to restrict certain parts of data that we have of you, we ask you to delete or amend your profile on

www.rabobank.jobs. If you are unable to access the data through your profile, you may request that the processing of your personal data be restricted.

7.5 Right not to be subject to automated decision-making
‘Automated decision-making’ refers to decisions made by computers rather than people. Rabobank is

permitted under the law to make automated decisions, including profiling. Even though we are permitted to use automated decision-making, we currently do not use it in the job application process.

7.6 Right to object
You have the option to object to the processing of your personal data. In this case, we ask you to delete your profile on www.rabobank.jobs.

All requests can be directed to the HR department handling these. You can contact them via fm.am.WorkdaySupport@rabobank.com, or phone via (855) 886 9005 or +1-314-317-8175 for areas outside the USA.

7.8 Procedure
If you submitted one of the requests described above, we will respond to your request within 30 days of

receipt. Depending on the number of requests received and the complexity of the request(s), the period may be extended by another 30 days. We will keep you updated on the progress of your request. If the data you provided also contains third-party data, such third party may be requested in advance whether they object to their data being processed. You may be asked to further specify your request. We may also ask you to provide ID because we want to make certain that we are providing data to the right person. In some cases we may not be able to honor your request. For example, we will not delete the data if it is of significant importance to our processes or if there is a statutory obligation to retain it. We will notify you if this is the case.

8. Where can I address my question or complaint?

For complaints about the processing of personal data, you can approach the Rabobank division that processes your personal data. If the response is unsatisfactory, you may submit this to us at fm.am.WorkdaySupport@rabobank.com.

9. Can we amend our Privacy Statement?

The Privacy Statement may be modified from time to time. If there is new data to be processed, we will amend the Privacy Statement accordingly. You will be able to find the most up-to-date version of our Job Applicants Privacy Statement on our website, along with previous versions of this Statement. This is version 1.1, updated in February 2022.