Privacy Notice For Applicants

Date of publication: 02-05-2026

1. Introduction

Thank you very much for your interest in our company. In accordance with the provisions of Articles 13, 14 and 21 of the EU General Data Protection Regulation (GDPR), we hereby inform you about the processing of personal data transmitted by you as part of the application process and any personal data collected by us and your rights in this regard. To ensure that you are fully informed about the processing of your personal data as part of the application process, please take note of the following information.

If you have any further questions about the processing of your personal data and the GDPR, you can contact us or our data protection officer at any time.

We at Mutares manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.

In this privacy policy, we explain how we process your personal data if:

• You visit our Career Site (you being a “Visitor”)
• You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
• You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
• We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
• We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
• We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).

This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights. When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.

2. Your contacts

Name and contact details of the controller

Responsible for the processing of your personal data in the context of your application is:

Mutares SE & Co. KGaA

Arnulfstraße 19

80335 Munich

Germany

Phone: +49 89 9292 776 0

E-mail: info@mutares.de

Website: www.mutares.com

Contact: Human Resources (hr@mutares.com)

Contact details of the data protection officer

The designated data protection officer is:

DataCo GmbH

Sandstraße 33

80335 Munich

Germany

Phone.: +49 89 8967 551 000

E-mail: datenschutz@dataguard.de

Website: www.dataguard.de

3. About processing of personal data

Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analyzing, sharing, and deleting personal data.

There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. An example of a data protection law that is relevant for our use of your personal data, as described in this privacy policy, is the EU Data Protection Regulation (2016/679, “GDPR”).

Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller, and may not use the personal data for its own purposes.

We are the data controller when we process your personal data as described in this Privacy policy.

4. What personal data do we process?

All individuals

• Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
• Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
• Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
• Contact details - Such as your name, email address, telephone number and physical address.

Candidates

• Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
• Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
• Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
• Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.

5. Where do we receive your personal data from?

All individuals

• From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
• Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.

References

• From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.

Candidates

• From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
• From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
• From your references. If you provide us with references, we may collect information about you from them.
• Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.

6. Purposes of the processing and its legal basis

Your personal data will be processed for the following purposes:

a. Application Process and Employment Initiation

• Implementation of the application procedure and decision on the establishment of the employment relationship.
• Communication with you (e.g., telephone, email) during the application process.
• Implementation of pre-contractual measures (initiation of the employment relationship).
• Inclusion of applicant data in an applicant pool.
• Recording of interviews.

b. Career Site and Technical Operations

• Collecting information about your use of the career site, using cookies and other tracking technologies, as described in our Cookie Policy.
• Affected individuals: Visitors.
• Data categories: Device information.
• Maintaining, developing, testing, and ensuring the security and proper functioning of the career site.
• Affected individuals: Visitors.
• Data categories: Device information; technical and statistical data.
• Analysing how the career site and its content are used in order to gather statistics and improve operational performance.
• Affected individuals: Visitors.
• Data categories: Device information; technical and statistical data.

c. Candidate Relationship and Talent Management

• Providing you with updates about vacancies, if you have subscribed.
• Affected individuals: Connecting Candidates.
• Data categories: Contact details; communications data.
• Reviewing profiles and applications, including communication with you about your application or profile.
• Affected individuals: Connecting Candidates; Applying Candidates.
• Data categories: All categories listed in this notice.
• Collecting and evaluating your professional profile on our own initiative (sourcing) and contacting you accordingly.
• Affected individuals: Sourced Candidates; Referred Candidates.
• Data categories: All categories.
• Contacting you directly about specific or future vacancies.
• Affected individuals: Candidates.
• Data categories: All categories.
• Contacting you to ask for your participation in surveys.
• Affected individuals: Candidates.
• Data categories: All categories.

d. References

• Contacting you to request reference information about a candidate and evaluating the information you provide.
• Affected individuals: References.
• Data categories: Contact details; communications data.

e. Legal Rights and Obligations

• Protecting and enforcing our rights, interests, and the interests of others (e.g., in connection with legal claims).
• Affected individuals: Any individuals involved in the legal issue.
• Data categories: All categories listed in this notice.
• Sharing personal data with other recipients where necessary for the purposes described in this notice.
• Affected individuals: Depending on the purpose.
• Data categories: All categories.
• Assertion, exercise, or defence of legal claims arising from the application process

f. Use of AI-Supported Tools in the Recruitment Process

• Supporting and improving the efficiency, consistency, and quality of recruitment-related activities, such as reviewing and organising applications, matching candidate profiles with vacancies, summarising application materials, and supporting communication during the application process.
• Affected individuals: Applying Candidates; Connecting Candidates; Sourced Candidates; Referred Candidates.
• Data categories: All categories listed in this notice.
• AI-supported tools are used solely as decision‑support tools. No automated decision-making within the meaning of Article 22 GDPR takes place. Final decisions regarding the application process and the establishment of an employment relationship are always made by human decision‑makers.
• The processing is based on our legitimate interests in conducting an efficient and consistent recruitment process (Art. 6(1)(f) GDPR) and, where applicable, on the performance of pre-contractual measures (Art. 6(1)(b) GDPR).
• Appropriate technical and organizational measures are in place to ensure data protection, confidentiality, and security when using AI-supported tools.

Legal Bases for Processing:

Processing of special categories of personal data that have been made public - Art. 9 para. 2 lit. e GDPR

Insofar as special categories of personal data are processed that you have obviously made public, your data will be processed in accordance with Art. 9 para. 2 lit. e GDPR.

Processing for the purpose of asserting, exercising or defending legal claims or in the case of actions of the courts - Art. 6 para. 1 sentence 1 lit. f GDPR, Art. 9 para. 1 lit. f GDPR

If necessary, your data will be processed for the purpose of asserting, exercising or defending legal claims or in the case of actions of the courts pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, Art. 9 para. 1 lit. f GDPR.

Processing on the basis of consent - Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Art. 7 GDPR. Art. 7 GDPR, Art. 88 para. 1 GDPR in conjunction with § 26 para. 2 BDSG (German Federal Data Protection Act)

If you have given your consent to data processing, your data will be processed in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Art. 7 GDPR, Art. 88 para. 1 GDPR in conjunction with Art. 88 para. 1 GDPR. Art. 7 DS-GVO, Art. 88 para. 1 DS-GVO in conjunction with § 26 para. 2 BDSG processed.

Decision on the establishment of the employment relationship Art. 6 para. 1 sentence 1 lit. b GDPR, Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 BDSG

We process your data in order to make a decision on the establishment of the employment relationship. If you are hired by our company, your data will be processed for the purpose of implementing and terminating the employment relationship. Separate information about the processing of your personal data will be provided for this purpose.

Processing on the basis of legitimate interest - Art. 6 para. 1 sentence 1 lit. f GDPR

Insofar as the processing is carried out to safeguard a legitimate interest of us or a third party and your interests or fundamental rights and freedoms do not outweigh the former interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for data processing. Our legitimate interest arises in particular from the following reasons:

• Proper implementation and optimization of the application process
• Assertion, exercise or defense of legal claims

Processing of special categories of personal data - Art. 9 para. 2 lit. a GDPR

If you have given your consent to the processing of special categories of personal data, such as health data, religious affiliation or nationality, your data will be processed in accordance with Art. 9 para. 2 lit. a GDPR.

7. Whom do we share your personal data with?

We only transfer your personal data to external recipients if you have given your consent or if this is permitted by law.

Service providers

Like most companies, we also work with service providers who support us in managing the application process. When we use these service providers, it is necessary for us to pass on your personal data to them.

We work with the following service providers, with whom we share your personal data:

Service

Provider

Reason for sharing your data

Company headquarters

Personio

Personio SE & Co. KG, Datenschutzhinweise

Personio is our HR tool. The information from your application will be stored in this system.

Seidlstraße 3, 80335 Munich, Germany

Microsoft Outlook

Microsoft Ireland Operations Limited, Datenschutzhinweise

We use Microsoft Outlook to communicate with you via email and conduct interviews.

One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland

Teamtailor

Teamtailor AB

Teamtailor is our applicant tracking system used to manage applications, candidate communication and the recruitment process.

Östgötagatan 16, 116 25 Stockholm, Sweden

Affiliated companies within the group

In addition to service providers, we may share your personal data with affiliated companies within our group for internal administrative purposes, including central human resources management and business operations.

Other recipients

In addition, personal data related to your application may be shared with the following categories of recipients, where necessary for the recruitment process or where legally required:

• Recruitment agencies (e.g. if your application is submitted via or supported by an external recruiter)
• Background check or verification service providers (e.g. reference, education or employment verification, where legally permitted)
• Courts, authorities, regulators or law enforcement bodies, where we are legally obliged to disclose data
• External legal or professional advisors, where necessary for the establishment, exercise or defence of legal claims

8. Transfer of personal data to a third country

In principle, the personal data collected and generated during the provision of relevant products and services is stored on our servers in the European Union. As the providers of our software solutions, among others, offer their products and/or services on the basis of available resources and servers worldwide, your personal data may be transferred to other jurisdictions outside the European Union and the European Economic Area or accessed from such a jurisdiction outside the European Union. In particular, personal data could be transferred to the third country, e.g. the United States, within the meaning of Art. 15 para. 2 GDPR. In order to ensure the continuation of the necessary level of protection when transferring data to a third country, contractual measures are agreed for this purpose. In order to ensure suitable guaran-tees for the protection of the transfer and processing of personal data outside the EU, data is transferred to and processed by our service providers on the basis of suitable guarantees in accordance with Art. 46 ff GDPR, in particular by concluding so-called standard data protection clauses in accordance with Art. 46 para. 2 lit. c GDPR.

9. For how long do we keep your personal data?

We will delete your personal data as soon as the purposes for its storage mentioned under point 4 no longer apply, or you object to the use of your personal data (in the case of processing on the basis of legitimate interests) or you revoke your previously given consent. However, your personal data may also be stored beyond this, in particular in the following cases:

• if contractual, legal or statutory retention periods prevent deletion
• for the assertion, exercise or defense of legal claims
• if this is required by European or national law to fulfill a legal obligation to which we are subject.

The following retention periods in particular result for us from statutory provisions:

• After decision on non-appointment: 6 months retention period for application documents (Section 15 (4) of the General Equal Treatment Act (AGG), Section 224 of the Code of Civil Procedure (ZPO)).

If the applicant gives consent to be included in the talent pool, their application documents will be stored for a maximum period of one year from the date consent is granted. The applicant may withdraw this consent at any time. The documents will be deleted once the purpose for storage no longer applies or if consent is withdrawn.

If you are hired by our company, your personal data will be deleted when the purpose no longer applies, at the latest after termination of the employment relationship, provided that there are no statutory retention periods to prevent deletion.

10. Your rights

You have the following rights under the GDPR:

• If your personal data is processed, you have the right to obtain information from the controller about the personal data stored about you (Art. 15 GDPR).
• If incorrect personal data is processed, you have the right to rectification (Art. 16 GDPR).
• If the legal requirements are met, you can request the erasure or restriction of processing (Art. 17 and 18 GDPR).
• If you have consented to the data processing or a contract for data processing exists and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR)
• If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes
• You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The relevant supervisory authority for Mutares is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, Phone: +49 (0) 981 180093-0, E-mail: poststelle@lda.bayern.de

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on lit. e of Article 6 para. 1 GDPR (data processing in the public interest) and lit. f of Article 6 para.1 GDPR (data processing on the basis of a balancing of interests), Article 21 para. 1 GDPR. This also applies to profiling based on this provision within the meaning of Art. 4 para. 4 GDPR, although we do not use automated decision-making or profiling within the application process.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate interests for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. The objection can be made informally.

If you have consented to the processing by the controller by means of a corresponding declaration, you can revoke your consent at any time for the future. The legality of the data processing carried out on the basis of the consent until the revocation is not affected by this.

11. Where can you turn with comments or questions?

If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to hr@mutares.com.

12. Updates to this Privacy policy

We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.

We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.