Marex - Privacy

Marex is committed to protecting your privacy.

Please see our privacy policy below for more information on how we collect, use and handle any personal data we collect during our recruitment process.

We'd love to be able to consider you for future job opportunities at Marex. By accepting, you consent to us keeping your CV for that purpose for 24 months.

RECRUITMENT PRIVACY NOTICE FOR MAREX ENTITIES

Marex Group Head Office Level Five 155 Bishopsgate, London, UK Tel: +44 (0)20 7655 6000 Fax: +44(0)20 7655 6024

In processing your personal data, the Marex Group (referred as ‘we’, ‘us’ or ‘our') is the Controller of your data. Please note that your personal data will be shared within the Marex Group for business administration purposes to the extent that is required. You can find the contact details of the Group Companies through the following link: https://www.marex.com/contact-us.

  1. SCOPE OF PRIVACY NOTICE

This notice applies to all individuals globally, who are applying to work for us. The UK General Data Protection Regulation (GDPR) is the most comprehensive privacy law and already includes most of the other privacy requirements globally. Therefore, Marex sets out the GDPR as the Gold Standard for the processing of personal data. The GDPR is used as the benchmark with the expectation of complying with also the applicable local laws. You have rights as per the GDPR and as set out in this Notice, irrespective of the country you are applying from. Additionally, you may have applicable rights as per the local legal requirements, such as under the California Consumer Privacy Act. This notice explains the categories of personal data we process, the purposes of processing the data and how that may affect you when you apply for a role at Marex. This notice explains: • what personal data we hold and why we process it; • the legal grounds which allow us to process your personal data; • where the data comes from, who gets to see it and how long we keep it; • the rights you have regarding the personal data we process and how to exercise the same; and • how to contact us. We have a separate Employee Privacy Notice that applies to our current and former employees. It will be provided to you if you receive and accept an offer from us.

  1. WHAT DO WE MEAN BY “PERSONAL DATA” AND “PROCESSING”?

“Personal data” is information relating to you or from which you may be identified. It includes not only facts about you, but also intentions and opinions about you. "Processing" means any operation which is performed on personal data. It includes the whole lifecycle of using the data from collecting it, holding it, disclosing it to deleting it, whether this is done manually or by automated means. References in this notice to employment, work (and similar expressions) include any arrangement we may have under which an individual applies to provide us with work or services. By way of example, when we mention an “employment application”, that includes an application to become engaged as a freelancer or a contractor. We use the word “you” to refer to anyone within the scope of the notice.

  1. WHAT ARE THE GROUNDS FOR PROCESSING?

Under data protection laws, there are various grounds on which we can rely when processing your personal data. In some contexts, more than one ground applies. We have summarised these grounds as Contract, Legal Obligation, Legitimate Interests, Consent, Vital Interest, Credit Protection, Dispute Resolution and Public Interest and outline what those terms mean in the following table. Where processing is based on a legal or contractual requirement or is necessary to enter a contract providing the data is required for us to be able to fulfil our obligations and exercise our rights. Failing to provide the requested information, may result into us not being able to proceed with the recruitment process.

Term Ground for processing Explanation Contract Processing necessary for performance of a contract with you or to take steps at your request to enter a contract. This covers preparation of a contract, carrying out our contractual duties and exercising our contractual rights and obligations. Legal Obligation Processing necessary to comply with our legal obligations. Ensuring we perform our legal and regulatory obligations. For example, providing a safe place of work and avoiding unlawful discrimination. Legitimate Interests Processing necessary for our or a third party’s legitimate interests. We or a third party have legitimate interests in carrying on, managing and administering our respective businesses effectively and properly and in connection with those interests processing your personal data. Your data will not be processed on this basis if our or a third party’s interests are overridden by your own interests, rights and freedoms.

Consent You have given specific consent to processing of your data. In general processing of your data in connection with employment is not conditional on your consent. However, there may be occasions where we do specific things such as request a reference and rely on your consent to our doing so. Vital Interest The processing is necessary in order to protect your or another person’s vital interests. This refers to emergency situations, where we cannot acquire consent or use another legal basis and are required to use your data. It is extremely rare for this basis to be used. Public Interest Processing is necessary for reasons of substantial public interest. This legal ground refers to any situation affecting the rights, health, or finances of the public at large. Credit Protection The processing is carried out to ensure the credit protection of the data subject. This refers to the processing activities related to credit activities/ situations of the data subjects (such as loan paying history). Dispute Resolution For the regular exercise of rights in judicial, administrative or arbitration procedures, the last pursuant to Law No. 9,307, of September 23, 1996 (the “Brazilian Arbitration Law”); Processing data to resolve disputes in the applicable avenues / forums.

  1. PROCESSING SPECIAL CATEGORY PERSONAL DATA

Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sexual orientation, sex life, trade union membership and genetic and biometric data are subject to stricter controls and security measures and considered by the applicable privacy laws to be “special category personal data” or “sensitive data” If we process special personal data about you, we will make sure that one or more of the additional legal grounds for processing special personal data applies. To outline, these include: • Processing being necessary for the purposes of your or our obligations and rights in relation to employment in so far as it is authorised by law; • Processing being necessary for the purpose of establishing, making or defending legal claims; and • Processing for equality and diversity purposes to the extent permitted by law.

  1. FURTHER INFORMATION ON THE DATA WE PROCESS AND OUR PURPOSES

The data, the purposes and the grounds on which we process the same are detailed in the table below. The examples in the table are not exhaustive but encompass the core activities we perform in the course of recruitment.

Purpose Examples of personal data that may be processed Grounds for processing* Recruitment Standard data related to your identity (e.g. your name, address, email address, ID information and documents, telephone numbers, place of birth, nationality, right to work, contact details, professional experience and education, including university degrees, academic records, professional licenses, memberships and certifications, awards and achievements, and current and previous employment details), financial information (including current salary information) language skills, and any other personal data that you present us with as part of your application related to the fulfilment of the role. We will also collect and process information concerning your application and our assessment of it including any background checks we may make to verify information provided and any information connected with your right to work. This may include as necessary for your role (and subject to legislation in your jurisdiction) checks verifying your job history, qualifications and previous renumeration as well as credit, criminal record, social media and adverse media checks. If necessary, we will also process information concerning your health, any disability and in connection with any adjustments to working arrangements. Should you be unsuccessful at this time, with your consent, we retain your CV for 24 months to consider you for other opportunities at Marex. Contract Legal Obligation Legitimate Interest Consent Administering our recruitment process Evaluating your experience and qualifications against the requirements of the position you are applying for. • Administering our online careers portal. • Information such as your proposed salary and (if applicable) envisaged bonus levels. • Communicating with you in respect of any offer of employment we choose to make and providing you with information about our onboarding process. Contract Legal Obligation Legitimate Interest Entering into a contract with you (if you are made an offer by us) Information on your terms of employment from time to time including your hours and working patterns, your pay and benefits, such as your participation in pension arrangements, life and medical insurance; and any bonus or share schemes. Contract Legal Obligation

Contacting you or others on your behalf Your address and phone number, emergency contact information and information on your next of kin. Contract Legitimate Interest Vital Interest

Payroll administration Information on your bank account, financial data such as salary, bonuses, pension contributions and on tax and national insurance Your National Insurance number or other government issued identifier. Contract Legal Obligation Physical and system security CCTV images upon attendance for interview at our premises, system security measures such as log information. Legal Obligation Legitimate Interest Providing information to third parties in connection with transactions that we contemplate or carry out Information on any offer made to you and your proposed contract and other employment data that may be required by a party to a transaction such as a prospective purchaser, seller or outsourcer. Legitimate Interest Legal Obligation Monitoring of diversity and equal opportunities Information on your nationality, racial and ethnic origin, gender, sexual orientation, religion, disability and age as part of diversity monitoring initiatives. Such data will be aggregated and used for equality of opportunity monitoring purposes. Please note we may share aggregated and anonymized diversity statistics with regulators if formally required / requested. Legal Obligation Meeting our duty of care and health and safety responsibilities in relation to Covid-19 We have a duty of care to ensure a safe place of work, as well as a duty of care to staff. For this reason, where reasonable and necessary, we may do the following in relation to Covid-19: • request information about whether you have had symptoms of the virus, close contract with confirmed cases or travelled to high-risk areas, whether you would be considered clinically vulnerable or clinically extremely vulnerable and whether you have been vaccinated. • conduct temperature checks before allowing entrance to our premises. • ask you to be PCR or Antibody tested before allowing entrance to our premises. Legal Obligation Legitimate Interest

Disputes and legal proceedings Any information relevant or potentially relevant to a dispute or legal proceeding affecting us. Legitimate Interest Legal Obligation Contract Dispute Resolution

  • For further explanation on the grounds of processing applicable to each purpose, please see the table in section 3

  • WHERE THE DATA COMES FROM?

When you apply to work for us, the initial data about you that we process is likely to come from you: for example, contact details, bank details and information on your immigration status and whether you can lawfully work in the country you applied to. Where necessary and in accordance with this Privacy Notice, we will require references and information to carry out background checks, in which case the data is obtained from the relevant third parties. We may also receive data from third party recruiters, agents and similar organisations as a part of the recruitment process. For further explanation of the grounds of processing applicable to each purpose, please see the table in section 3

  1. WHO GETS TO SEE YOUR DATA?

Where necessary and as set out this Privacy Notice, your personal data will be disclosed to relevant managers, HR and administrators for the purposes of proceeding with your application as described in this Notice. We will also disclose this to other members of the Group where necessary for decision making regarding your application – this will depend on the role you are applying for. We will only disclose your personal data outside the Group if the disclosure is consistent with a ground for processing on which we rely and doing so is lawful and fair to you. We will disclose your data if it is necessary for our legitimate interests as an organisation or the interests of a third party. However, we will only do this if these interests are not over-ridden by your interests and rights to privacy. Where necessary, we will also disclose your personal data if you consent to it, where we are required to do so by law and in connection with criminal or regulatory investigations. Examples of the circumstances in which your personal data may be disclosed include: • Disclosure to organisations that process data on our behalf such as our payroll service, insurers and other benefit providers, our bank and organisations that host our IT systems and data. This would normally occur if you accept an offer from us and would be carried out as part of the on-boarding process; • To third party recruitment consultants and similar businesses (including online recruitment portals) as a part of the recruitment process; and • Disclosure of aggregated and anonymised diversity data to relevant regulators as part of a formal request (see above).

  1. INTERNATIONAL DATA TRANSFERS OUTSIDE OF THE REGION YOU APPLY FROM - MORE INFORMATION

In connection with our business and for employment, administrative, management and legal purposes, we will, where necessary and as set out in this Privacy Notice, transfer your personal data outside of the country or region you are applying from, including from the UK and/or the EEA to members of our Group and our trusted service providers in relevant jurisdictions. Recruitment related application is hosted in UK. We require everyone we work with to keep your personal data confidential and secure. We ensure that suitable protection is maintained at all times by ensuring that appropriate safeguards are in place.

  1. RETAINING YOUR PERSONAL DATA – MORE INFORMATION

For determining how long to keep your data, we will consider its relevance to our business and your potential employment in the future. We only keep your personal data for as long as it is required by us for the: • purposes described above; • to meet our legal or regulatory obligations; • for the exercise and/or defence of any legal claims. Should you be unsuccessful at this time, where you have consented, we will keep your CV and details for 24 months following the position being applied for having been filled. IF YOU WOULD LIKE YOUR CV TO BE REMOVED FROM OUR RECORDS FOR THE PURPOSE OF BEING CONSIDERED FOR FUTURE ROLES, YOU CAN CONTACT OUR HR BY E-MAILING: RECRUITMENT@MAREX.COM.

  1. YOUR RIGHTS

The UK and EU GDPR and the applicable national laws, such as the LGPD and the PDPA provide you certain rights in relation to the personal data we process of you. The rights mentioned here also encompass other local rights, which are similar in nature, and you can further find details of additional rights below. Please note, that exercising your rights is limited to the extent we are legally required to, or capable of, to fulfil your request. This means, that even if you make a request, we may not be able to comply with it partially or fully. This is due to country specific limitations to the rights, or another legally compliant reason, such as for example our legal obligation to continue processing the personal data for compliance purposes. Where we do not comply with your request, we will inform you of the reasons for not doing so.

Under the UK and EU GDPR, you have the right to: • Access the personal data we process of you by requesting a copy; • Have your personal data rectified; • Have your personal data erased; • Object to the processing of your personal data; • Have your personal data processing restricted; • Withdraw your consent to process your personal data for a purpose you previously consented to. Withdrawing consent does not affect the lawfulness of processing, which was done before consent was revoked; • Receive a limited set of data transferred directly to another controller or processor, or directly to yourself; and • You also have the right to object to being subjected to profiling and automated decision-making and require a human review of any automated decision. However, we DO NOT process personal data in a manner, which would make this right applicable. Based on the local Privacy Laws of the country you reside in, you may also be entitled to some additional rights, subject to certain exceptions. Hence, in addition to the rights listed above and the principles we are bound by, you may exercise the following rights, if you are based in one of the following countries or otherwise subject to the local laws: Country Additional Rights Available US • Right to Opt out of the Sale of Personal Information. However, we do not “sell” your personal information, as that term “sell” is used in the CCPA; • Right to Notification of Financial Incentive. However, we do not offer incentives for the collection, sale or deletion, of personal data; • Right Not to be Discriminated. We will not discriminate against you for exercising these rights. Brazil • Right to information about public and private entities with which the controller has shared data

To exercise your rights, you can contact our Group Data Protection Officer (DPO) and the Privacy Team by emailing: DataProtectionOffice@marex.com. Please note when you request to exercise any of your rights, we may request specific information from you to help us confirm your identity and keep your personal data protected.