Candidate Privacy Notice

Last Updated: July 1, 2025

1. Introduction

This Candidate Privacy Notice ("Notice") applies to each of the PingPong Group of companies, specifically, PingPong Europe S.A., PingPong Payment (UK) Limited, PingPong Global Solutions Inc., and ManaPayment Australia Pty Ltd (hereafter collectively "PingPong," "we," "us," or "our").

This Notice outlines how PingPong collects, uses, stores, and discloses personal data concerning individuals (collectively, the "Candidates") who:

• apply for open positions with us;
• are contacted by us for potential employment opportunities;
• express interest in employment with us; and
• participate in recruitment events, interviews, or assessments

This Notice also describes the rights that Candidates may have in relation to their personal data.

If you are located or reside in the European Economic Area ("EEA"), the United Kingdom ("UK") or Switzerland, please refer to Section 7 for details about the specific PingPong entity acting as the data controller for your personal data.

2. What Personal Data Do We Collect About You?

We control how your personal data is collected as well as the purposes for which we use your personal data.

Personal data means any information that relates to you and allows us to identify you, either directly or indirectly through a combination of other information held by us. We collect only the personal data necessary to manage our recruitment process and comply with applicable legal obligations.

We may collect the following categories of personal data:

• Identification data: name, surname, title, gender, date of birth
• Contact information: residential address, e-mail address, and telephone number
• Profile information: resume, curriculum vitae, cover letter, and information provided by recruiting or executive search agencies
• Professional or employment information: work history, current/past positions, current/past employers, performance information, and references provided by your current and previous employer
• Education information: academic degrees, professional qualifications, certifications, training courses, publications, transcript information, background information provided or confirmed by academic institutions and training or certification providers
• Recruitment process information: information collected through the application process, screening responses, assessments, interview notes
• Right to work documentation: nationality, immigration or visa information
• Background check data: criminal record information, if legally permitted and required
• Other information: compensation history, work preferences, or any other voluntarily submitted personal data

How We Collect Your Data

In most cases, we collect personal data from you, such as when you submit a job application or provide information as part of the interview process. We may also create personal data about you during the application process such as interview notes or job assessments.

If required, we may collect your personal data from other sources including:

• Our referral program which enables current employees to recommend potential new hires;
• Other individuals such as references during the application process, including your current or past employer, coworkers, or friends;
• Publicly accessible sources such as LinkedIn, where we collect your: name, email, education and work history, and other relevant data;
• External third parties, such as professional or sanctions registries, background information provided or confirmed by academic institutions and training or certification providers and recruiting or executive search agencies.

Only the data that is strictly necessary for processing your application is requested.

We do not request or process sensitive personal data (special categories of data) such as racial or ethnic origin, political opinions, religious beliefs, or data concerning health, sex life, or sexual orientation.

By providing your data, you expressly agree that your data will be processed by PingPong for the purposes described in this Notice. In certain cases, we may not be able to process your application further, if you do not provide us with the personal data described.

3. How Do We Use Your Personal Data?

We may process your personal data for the following purposes:

Automated decision-making / profiling: PingPong does not utilize automated individual decision-making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain things about the candidate). If this changes, we will notify you and explain your rights, including your right to object.

Whenever we process your personal data based on your consent, you have the right to withdraw your consent at any time by contacting our Data Protection Officer or via the Contact Us page. The withdrawal of consent will not affect the lawfulness of processing prior to withdrawal.

4. Who Has Access to Your Personal Data?

Your personal data will only be accessed by those involved in the recruitment process on a need-to-know basis, such as members of the HR department, hiring managers and other PingPong employees involved in the decision-making process.

PingPong takes appropriate steps to ensure that individuals who receive your data are bound to maintain confidentiality of the data.

We may also share your personal data with third-party service providers acting on our behalf such as:

• Professional advisors, such as lawyers, accountants, and auditors
• Payroll service providers
• Service providers, such as data storage and platform providers

For any third party that we use, we will confirm that they provide sufficient guarantees regarding the protection of your data. All third parties are contractually obligated to implement appropriate technical and organizational safeguards and to protect the confidentiality of your data.

We may also share your personal data with government authorities to respond to lawful requests such as the social security agency, law enforcement agencies and immigration authorities, etc.

Governmental authorities act as data controllers and may use your personal data for their own purposes. As such, we are not responsible for their handling of such data. In such instances, we encourage you to refer to their privacy notice for further details on how your personal data is being handled.

5. How Do We Keep Your Personal Data Safe?

We have implemented appropriate technical and organizational measures to safeguard your personal data, including security measures to protect against unlawful or unauthorized processing of personal data, and against the accidental loss of, or damage to, your personal data. These measures are regularly reviewed and updated to maintain an adequate level of protection, in line with applicable data protection laws.

6. How Long Do We Retain Your Personal Data?

If you are hired and commence employment with PingPong, your personal data will be retained in accordance with our data retention policies.

However, if you are not selected for the role, the following may apply:

• If you did not participate in interviews, your data is deleted immediately following rejection.
• If you participated in interviews and did not consent to data retention, your data is deleted immediately following rejection.
• If you participated in interviews and consented to retention, we may retain your data for up to one (1) year to consider you for future roles.

In any case, assessment data and interview notes may be retained for up to two (2) years to avoid duplication of recruitment efforts.

7. Additional Information for Candidates Located in EEA, UK, and Switzerland

This section applies to our processing of European Economic Area (i.e., European Union Member States, Iceland, Liechtenstein, Norway), UK and Swiss personal data. This section shall govern and prevail with regard to the processing of EEA, UK and Swiss personal data.

Data Controller: The PingPong entity responsible for processing your personal data is the one with whom you interact during the recruitment process.

Data Subject Rights: You have certain rights regarding your personal data in line with the EU/UK GDPR, including:

• The right of access: You can request access to your data at any time.
• The right to rectification: If your personal data is inaccurate or incomplete, you can request rectification at any time.
• The right to erasure (right to be forgotten): You can request that your data be deleted when, for example, the data is no longer necessary for the purposes for which it was collected or processed.
• The right to restriction of processing: You can request the restriction of the processing of your data if, for example, you question the accuracy of the data concerning you or if you object to the processing of data concerning you.
• The right to data portability: You have the right to have your data transferred to another data controller in a structured, commonly used and machine-readable format.
• The right to object to data processing: You can object to the processing of your data and can withdraw your consent if the processing is based on consent, for example if your data is used for marketing purposes.
• Right to Refuse or Withdraw Consent: In case we ask for your consent to process your personal data, you have the right to refuse to give consent, and you can withdraw your consent at any time by contacting the appropriate Data Protection Officer (DPO). The lawfulness of any processing of your personal data that occurred prior to the withdrawal of your consent will not be affected.

Contact our Data Protection Officers: You can exercise your rights by contacting the relevant Data Protection Officer (DPO) by email or post:

• PingPong Europe S.A: Data Protection Officer, Rue du Laboratoire 9, L-1911, Luxembourg, dpo@pingpongx-eu.com
• PingPong Payment (UK) Limited: Data Protection Officer, 78 Cannon Street, London, England, EC4N 6HL, United Kingdom, dpo-uk@pingpongx-uk.com

The DPO will respond to your request within one (1) month of receipt of the request, commencing as soon as we have confirmed your identity. We may extend the period to two (2) months, taking into account, the complexity and/or if we have received a high number of requests from individuals. In this case, the DPO will inform you of the delay, together with the reasons.

We may request additional information to help us confirm your identity where deemed necessary. This is a security measure to ensure the non-disclosure of your personal information to an unauthorized person.

In general, any communication or action taken by us in response to your request will be provided free of charge. However, we have the right to refuse to act on your request if we cannot identify you, or where your request to exercise your rights is manifestly unfounded or excessive, in particular because of their repetitive character. We may also charge a reasonable fee, taking into account the administrative costs of providing the information or taking the action requested.

Right to Lodge a Complaint: If you believe we have not handled your personal information properly in line with GDPR or If you are unhappy with how we have handled your requests, you have the right to lodge a complaint with the relevant supervisory authority or seek a judicial remedy.

• PingPong Europe S.A: If this entity (data controller) handles your recruitment process, report to the National Commission for Data Protection ("CNPD"), Luxembourg.
• PingPong Payment (UK) Limited: If this entity (data controller) handles your recruitment process, report to the Information Commission's Office (ICO), UK.

International Data Transfers outside the EEA and UK: We may transfer your personal data to our affiliate companies or third parties outside the EEA/UK.

When your personal data is transferred (including remote access) to a third country that is not subject to an adequacy decision, appropriate safeguards in accordance with Chapter V of the GDPR are put in place, such as the EU Standard Contractual Clauses adopted and approved by the European Commission, and/or the UK International Data Transfer Agreement/UK International Data Transfer Addendum.

8. Additional Information for California Residents

Pursuant to the California Consumer Privacy Act ("CCPA"), this section applies to certain personal data collected about candidates that are California residents and supplements the rest of our Notice above. This section does not apply to candidates who are not California residents.

Data Controller: PingPong Global Solutions Inc, 1510 Fashion Island Blvd, Suite 250, San Mateo, CA 94404

Your California Data Protection Rights

This section supplements the Notice for California residents under the California Consumer Privacy Act (CCPA).

Data ControllerPingPong Global Solutions Inc.1510 Fashion Island Blvd, Suite 250, San Mateo, CA 94404

Your CCPA Rights

• Right to Know: Request disclosure of categories and specific pieces of personal data we collect, use, and disclose.
• Right to Delete: Request deletion of your personal data.
• Right to Correct: Request correction of inaccurate personal data.

Requests may be submitted via post or by contacting the data controller directly via email at: privacy@pingpongx.us. We will not discriminate against you for exercising your rights. Responses will be provided within one month, extendable where necessary.

9. How Do We Handle Other Jurisdictions?

If you are a Candidate of any other PingPong Group entity, your rights will depend on the local laws of the jurisdiction in which the entity is registered. Please contact your Recruiting Partner for additional information.

10. Do We Make Updates to This Notice?

We may update this Candidate Privacy Notice from time to time to reflect changes in legal, regulatory, or operational requirements. The updated version will be indicated by an updated "Last Updated" date and the updated version will be effective as soon as it is published. If we make material changes to this Notice, we may notify you either by posting a notice of such change or by directly sending you a notification. We encourage you to review this Notice frequently to be informed of how we are protecting your personal data.

This Candidate Privacy Notice should be read together with our general Privacy Policy.

‍