AFFINIUS CAPITAL APPLICANT DATA PROTECTION NOTICE
Last Updated August 2025
Affinius Capital, its subsidiaries and affiliates, including Affinius Capital Europe B.V., Affinius Capital UK Ltd, Mountpark Properties Ltd and Mountpark Realco Cooperatief NL UA, and their affiliates (together, “Affinius Capital”, “we”, “our” or “us”), are providing this Applicant Data Protection Notice (“Notice”) to explain what personal data we collect regarding employee recruiting, how we use that data, and your rights.
This Notice does not apply to any processing of personal data by or on behalf of us that is covered by a more specific privacy notice (including, but not limited to, our privacy notices for current employees and contractors). By submitting your application for employment, you consent to Affinius Capital processing your personal data.
Personal Data That We Collect
- Personal data that you provide: To process your application, we ask you to provide certain personal data. You provide the information voluntarily, and you determine what information to provide. However, some information is required for us to complete our evaluation of your application, and without sufficient information we may have only a limited ability to evaluate you as a candidate. When you complete an employment application, we collect information about your education and employment history, contact information, job qualifications, eligibility, and job interests. You may provide additional information, such as your resume, transcripts, references, and compensation request.
- Data we receive from other sources: We may obtain information about you from other sources, to the extent permitted by applicable law, which sources include employment research firms, recruiters, identity verification services, and other Internet websites (for example, LinkedIn). In addition, where permitted by law, we use a third party to carry out a background check to determine your suitability for a position.
How We Use Personal Data
Affinius Capital uses your personal data collected in our recruiting process in the following ways:
o to process and evaluate your application and make hiring decisions (necessary to respond to your request that we process your application for employment);
o to communicate with you and inform you of current and future career opportunities;
o to manage and improve our recruiting and hiring processes;
o to conduct reference and background checks where required or permitted by applicable local law or for compliance with corporate governance and legal and regulatory requirements (e.g., to perform background checks through service providers (including in relation to fraud), compliance with investigations and audits by government, supervisory or regulatory authorities, etc.); and
o equality and diversity monitoring in the workplace; safeguarding the Affinius Capital’s business interests, including its intellectual property and confidential information, and to prevent fraud; in connection with dealing with legal and/or regulatory disputes, investigation and proceedings; in connection with an actual or prospective corporate transaction (including a sale, divestment, merger or acquisition of all or any part of our business), restructuring or investment with respect to which we are a party; carrying out investigations and audits to verify and ensure compliance with internal policies; for other business operations reasons, including sharing among the Affinius Capital’s affiliates for administrative purposes and provision of centralized systems and services.
If you are hired, your personal data will be maintained and used as part of your employee record, including, if required under the applicable jurisdiction in which you reside, under our Employee Privacy Policy.
Storage and Retention of Personal Data
Affinius Capital will retain personal data to the extent required to fulfill the purposes described in this Notice and in accordance with our retention policies, unless a longer period is required to comply with applicable law. However, we may retain your personal data for longer if you tell us that you want to be informed of current and future career opportunities as described in this Notice.
When we have no justifiable business need to process your personal data, we will either delete or anonymize it in a way that it may no longer be associated with any individual, so it is no longer personal data.
Protection of Personal Data
Affinius Capital understands the importance of securing personal data, and uses reasonable administrative, physical, and technological security measures to help prevent personal data from unauthorized use, access, or disclosure.
Jurisdiction-Specific Information
If you are located in the European Union (“EU”), European Economic Area (“EEA”), the United Kingdom (“UK”), and/or Switzerland, or the processing of your personal data would otherwise be subject to the EU-UK Data Protection Laws (defined below), please refer to the Residents of the EU, EEA, UK and Switzerland section below.
If you are located in California please refer to the Residents of California section below.
Notice Changes
Affinius Capital and any successors may revise this Notice from time-to-time. If a material change is made to this Notice, then we will notify you of the change in accordance with the applicable law.
Transfer of Business
On a merger, consolidation, sale, or transfer of all or substantially all of the assets or business of Affinius Capital, we may need to transfer your personal data in our possession to the relevant successor to the business. Affinius Capital will advise those successors of the terms of this Notice and of our expectation that the successors will adopt and maintain this Notice until there is a notification of an amendment of this Notice.
Contact
For more information about this Notice, please contact Affinius Capital's Human Resources Department at Employment@affiniuscapital.com.
Residents of the EU, EEA, UK and Switzerland
This “Residents of the EU, EEA, UK and Switzerland” section supplements information contained in the Notice above and applies solely to the processing of personal data which is subject to EU-UK Data Protection Laws. For the purpose of this section, “UK-EU Data Protection Legislation” means all applicable legislation and regulations relating to the protection of personal data in force from time to time in the EU, EEA, UK, and/or Switzerland, including Regulation (EU) 2016/679 (the General Data Protection Regulation) (the “EU GDPR”), the GDPR as it forms part of the laws of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union Withdrawal Act 2018 (the “UK GDPR”), and any implementing or successor legislation, or amendment or re-enactment, of any of the foregoing. The terms “controller”, “personal data”, “personal data breach” and “processing” in this Notice shall be interpreted in accordance with the applicable UK-EU Data Protection Legislation.
Controllers
One or more of the Affinius Capital entities will be the “controller” of any personal data. In simple terms, this means that we: (i) “control” the personal data that we process about you; and (ii) make certain decisions on how to use and protect such personal data.
Purposes and Legal Bases for Processing Personal Data
Affinius Capital uses your personal data collected in our recruiting process for the following purposes and on the following legal basis:
• Purpose: to process and evaluate your application and make hiring decisions (necessary to respond to your request that we process your application for employment).
o Lawful Basis: our legitimate interest to decide whether to appoint you to the role since it would be beneficial to our business to appoint someone to that role. In relation to the processing of sensitive data (such as health or ethnic information) collected in connection with someone’s application, the processing is necessary to carry out our obligations in compliance with applicable law and/or to enter into a contract with you.
• Purpose: to communicate with you and inform you of current and future career opportunities.
o Lawful Basis: our legitimate interest in operating our business (unless you tell us that you do not want us to keep your details for that purpose).
• Purpose: to manage and improve our recruiting and hiring processes.
o Lawful Basis: performance of a contract and our legitimate interest in operating our business (unless you tell us that you do not want us to keep your details for that purpose).
• Purpose: to conduct reference and background checks where required or permitted by applicable local law or for compliance with corporate governance and legal and regulatory requirements (e.g., to perform background checks through service providers (including in relation to fraud), compliance with investigations and audits by government, supervisory or regulatory authorities, etc.).
o Lawful Basis: compliance with our legal obligations and our legitimate interest.
• Purpose: equality and diversity monitoring in the workplace; safeguarding the Affinius Capital’s business interests, including its intellectual property and confidential information, and to prevent fraud; in connection with dealing with legal and/or regulatory disputes, investigation and proceedings; in connection with an actual or prospective corporate transaction (including a sale, divestment, merger or acquisition of all or any part of our business), restructuring or investment with respect to which we are a party; carrying out investigations and audits to verify and ensure compliance with internal policies; for other business operations reasons, including sharing among Affinius Capital’s affiliates for administrative purposes and provision of centralized systems and services.
o Lawful Basis: Our legitimate interest in operating our business.
• Any other purpose that has been notified, or which has been consented to in writing.
o Lawful Basis: As detailed in the Notice or on consent.
If you are hired or engaged by us, your personal data will be maintained and processed as part of your employee or contractor record under our employee or contractor privacy notice (as applicable).
Sharing and Disclosure of Personal Data
We share your personal data in compliance with UK-EU Data Protection Legislation to the following persons only as necessary for the purposes described above:
• Affinius Capital Affiliates: If your application relates to employment or a contractor engagement with an Affinius Capital affiliate, then Affinius Capital will share your personal data with that affiliate. Our affiliates will be required to treat your personal data in accordance with this Notice. Affinius Capital affiliates may also act as service providers amongst each other to assist in the administrative activities required in processing applicant personal data.
• Service Providers: Affinius Capital uses other companies and individuals to provide services on its behalf and may share personal data with our financial and transaction counterparties, our professional advisors, auditors, recruitment firms, consultants (including payroll employment consulting), background check providers, IT, cloud services and data security providers, your agents and representatives, and other third parties. These providers process or store personal data while performing their contractual duties to Affinius Capital. We require that the service providers process your data only pursuant to our instructions and solely to meet their contractual obligations in the performance of the specific functions described above, and have appropriate measures in place to protect that data. If these providers are located outside the EEA or the UK, then Affinius Capital will ensure protection of your personal data when transferring the data to those providers to the extent required by UK-EU Data Protection Legislation.
• Other third parties: Affinius Capital may disclose your data: (i) if required or permitted to do so by law or legal process (such as when part of a governmental agency action or litigation); (ii) to law enforcement authorities, regulators and/or governmental or quasi-governmental entities and/or other competent authorities based on a lawful disclosure request; (iii) when we believe disclosure is necessary or appropriate to prevent harm or financial loss, or to otherwise protect our rights, or in connection with an investigation
of suspected or actual fraudulent or illegal activity or any other legal or investigatory process involving us.
• Transfer of business: We may disclose or transfer personal data we have about you or otherwise process in the event that we sell or transfer (or contemplate selling or transferring) all or a portion of our business or assets (including in the event of a takeover, divestment, reorganization, spin-off, dissolution or liquidation) to the new owner of the relevant business and their advisors (and Affinius Capital will advise those successors of the terms of this Notice and of our expectation that the successors will adopt and maintain this Notice until there is a notification of an amendment of this Notice).
Storage and Retention of Personal Data
In addition to the retention policies discussed above, personal data submitted as part of your application may be transferred to Affinius Capital in the United States if necessary to process your application for employment and in compliance with UK-EU Data Protection Legislation. The United States may have data protection laws less stringent than or otherwise different from the laws in effect in the country in which you are located. We will take steps to ensure that your personal data receives an adequate level of protection where it is processed. If you are hired, then your personal data will be transferred pursuant to standard contractual clauses for the transfer of personal data between Affinius Capital Europe, B.V. or Affinius Capital UK Ltd. and Affinius Capital.
Rights in Relation to Personal Data
You may have certain rights with respect to your personal data under applicable UK-EU Data Protection Legislation. Subject to the UK-EU Data Protection Legislation, you have certain rights in relation to your personal data, which may include:
• Right of access: If you ask us, we will confirm whether we are processing your personal data and, if we are, provide you with a copy of that personal data along with certain other details. If you require additional copies, we may need to charge a reasonable fee.
• Right of erasure: You may ask us to delete or remove your personal data.
• Right to object to processing: You may ask us at any time to stop processing your personal data, and we will do so when the legal basis of the processing is a legitimate interest (described under the “How we use personal data” section of this Notice), unless Affinius Capital demonstrates compelling, legitimate grounds for the processing.
• Right to data portability: You may obtain personal data from Affinius Capital when the legal basis of the processing is consent or the necessity of the processing to perform a contract.
• Right to rectification: You may require Affinius Capital to correct any inaccurate or incomplete personal data.
• Right to restrict processing: You may ask that Affinius Capital restrict processing of personal data in certain circumstances (for example, where you believe that the personal data is not accurate or lawfully held, or when you previously objected to the processing).
• Right to lodge a complaint with a supervisory authority: If you have a concern about Affinius Capital’s data protection practices, including the way that the Affinius Capital
has handled your personal data, you may report it to the supervisory authority authorized to hear those concerns.
If you would like to exercise any of the above rights, please contact gdprinforequest@affiniuscapital.com so that we may consider your request under applicable law. To protect your privacy and security, we may take steps to verify your identity before complying with the request.
If you have requested a copy of your personal data, Affinius Capital may request that you pay a “reasonable fee,” if we think that your request is excessive, to help us cover the costs of locating the information that you have requested.
Please note that the right to erasure is not absolute and it may not always be possible to erase Personal Data on request, including where the Personal Data must be retained to comply with a legal obligation. In addition, erasure of the Personal Data requested to fulfill the purposes described in this Notice may result in the inability to consider your application.
Residents of California
This “Residents of California” section applies to natural person California residents and is only relevant to you if you are a resident of California as determined in accordance with the California Consumer Privacy Act, as amended (the “CCPA”). This section augments the Notice with respect to those rights a resident of California may have under the CCPA.
The types of personal data we collect about you depends on the nature of your interaction with us. The categories of personal data we have collected, or may collected from you as an applicant over the last twelve (12) months include the following:
We do not collect or use sensitive personal data other than:
• To perform services, or provide goods, as would reasonably be expected by an average consumer who requests those goods or services;
• As reasonably necessary and proportionate to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal data;
• As reasonably necessary and proportionate to resist malicious, deceptive, fraudulent, or illegal actions directed at us and to prosecute those responsible for such actions;
• For short-term, transient use (but not in a manner that discloses such information to another third party or is used to build a profile of you or otherwise alter your experience outside of your current interaction with us);
• To perform services on behalf of our business;
• To verify or maintain the quality or safety of a service or to improve, upgrade, or enhance such service or device; and
• To collect or process sensitive personal data where such collection or processing is not for the purpose of inferring characteristics about a consumer.
We do not share (i.e., disclose to a third party for the purpose of cross-context behavioral advertising) or sell (as such terms are defined in the CCPA) any of the personal data we collect about you to third parties.
Within the last twelve (12) months, we have disclosed personal data collected in connection with our recruiting process for a business purpose to the categories of third parties indicated in the chart below. We may also disclose your information to other parties as may be required by law or regulation, or in response to regulatory inquiries.
The CCPA may provide residents of California with the following rights with respect to your personal data:
• Right to know the categories of personal data we have collected about you;
• Right to know the specific information we have collected about you;
• Right to correct inaccurate information that we maintain about you; and
• Right to request that we delete any information we have collected about you in accordance with applicable law.
To submit a request pursuant to any of these rights, please contact us at:
• Phone: 800 531 8182
• E-mail: dataprivacy@affiniuscapital.com
• Visitor address: 9830 Colonnade Boulevard, Suite 600; San Antonio, TX 78230
Please be sure to provide your full name and mailing address so that we can fulfill your request. When you exercise these rights and submit a request to us, we may verify your identity by asking for certain information. You will not receive discriminatory treatment for the exercise of these privacy rights.