Applicant Privacy Notice

1. Introduction

World Gold Council (including our affiliates and joint ventures, "we", "us", "our" or "WGC") values your trust and is committed to the responsible management, use and protection of personal data within information collected during the job application and recruitment process. Personal data means any information relating to an identified or identifiable individual, including, for example, your name, phone number, residential address or email address. This Applicant Privacy Notice describes how we collect, use and retain personal data of job applicants (including for any type of employment, internship or similar individual role) and their rights in relation to our collection and use of their personal data.

The relevant WGC data controllers of your personal data will depend on where you are located. Please see Appendix 1 for a list of our subsidiaries and affiliates that act as data controllers over applicant personal data.

This Applicant Privacy Notice may be amended from time to time. We may provide you with a new Applicant Privacy Notice if we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.

2. Collection of Applicant Personal Data

WGC seeks to ensure that its collection and processing of applicant personal data is always proportionate. Personal data collected by WGC may include the following (whether such information is provided by staff or by a third party, to the extent permitted under local law):

1. Identifiers: Personal contact details such as name, title, addresses, telephone numbers, personal email addresses, country of residence (state or province, if applicable), date and place of birth and gender
2. National identifiers: Work authorisation status / work permits and needs for future sponsorship, nationality / national identity number / passport number / driving license number
3. Marital status and dependents: Spouse and children, next of kin and emergency contact information
4. Education / qualifications and professional or employment-related information: CV, resume, cover letter, university degrees, diplomas, high-school and college certifications and any other education information (for example, courses, training etc.), previous work experience, description of current position, job title, company name, employment status, role(s) for which you are applying, job application and accompanying documentation/communication, cover letters, professional and other work-related licenses, permits and certifications held, information from assessments and interviews, including, where applicable, screenshots captured during online interviews, online assessments that may use AI features with human review, compensation/benefit requests, relocation information, information relating to references and work history
5. Other recruitment information: Copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process
6. Checks carried out on you: Background check reports, performance information, disciplinary and grievance information
7. Other: Any other information you elect to provide to us (e.g., employment preferences, skills, willingness to relocate, desired salary, awards, or professional memberships)

Except where legally required, WGC will not generally request – and asks that candidates avoid voluntarily submitting – the following personal data, which may qualify as sensitive personal data (or special categories of personal data) under applicable law: race, religion, ethnicity, nationality or national origin, age, gender identity, sexual practices or orientation, marital status, medical or health personal data (including disability status), genetic or biometric personal data, biometric templates, political or philosophical beliefs, political party or trade union membership or veteran status.

Where you are asked to complete a background check (which may include sensitive data such as criminal record checks), we may provide you with an additional specific notice or permission form.

If you are taken on to work at WGC we will collect other personal data, in accordance with our Staff Privacy Notice.

3. How We Use Your Personal Data

Your personal data will only be processed to the extent permitted by applicable laws. The main purposes for which WGC may use your personal data are set out below. Please note that in addition to the disclosures we have identified below, we may disclose your Personal Data for the purposes set out below to the recipients specified in section 5 below.

We process your personal data in order to assess your application prior to you entering into an employment or other work contract with us and pursuant to laws to which WGC is subject. This may involve the collection of personal data in order to:

• to assess your capabilities and qualifications for a job;
• to administer technical assessments through trusted third-party platforms;
• to verify the identity of applicants and maintain accurate interview records;
• to conduct reference checks;
• to respond to your inquiries and communicate with you about your application;
• to comply with or monitor compliance with any applicable law or regulation; and
• to conduct background checks if we offer you a position, subject to applicable law.

We may also use the personal data we collect as we believe to be necessary or appropriate under applicable law, including: laws outside your country of residence, to comply with legal process, to protect our rights and comply with our legal obligations or requests from public and governmental authorities.

• This processing is generally a necessary pre-condition of entering into any future contract with you and for WGC to fulfil its obligations with respect to other employees and you yourself (should you be employed by WGC). We will assess your application on the basis of your suitability to the advertised role.
• If you are unable to provide us with the information requested, we may be unable to assess your appropriateness for the job applied for or to communicate with you.

4. Sources From Which We Collect Personal Data

WGC obtains personal data directly from you, for example: in your job application, forms you complete for us, and any personal data you provide us during the course of your application and the recruiting process. In addition, WGC may obtain personal data about you from its recruitment agents (to whom you may provide personal data directly), or from your references or from a background check report and from publicly available data.

5. Sharing Applicant Personal Data and Transfers of Your Personal Data Outside Your Country of Residence

Your Personal Data may be held at the offices of any WGC company. As part of the recruitment process, we may share your personal data within our group for the purposes described at section 3 above. Please refer to Appendix 1 for the list of the WGC data controllers of personal data.

WGC may share your personal data with third parties for the purposes described at section 3 above including where required by law and where those third parties and or affiliates are involved in evaluating candidates for a given position. Third parties include third-party service providers (including contractors and designated agents) and professional advisers. The following activities are carried out by such third-party service providers: recruitment assistance, background check processing and similar services. WGC may transfer information to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

WGC may also be required to share some of your Personal Data as required to comply with applicable laws, or as permitted by law or to protect or defend its rights and interests or those of others.

As part of the recruitment process, your personal data may be transferred internationally for the reasons described above to or from the UK, US, India, Japan, UAE, China, Singapore (where WGC currently has offices or companies) and to other countries around the world, including countries that do not have data protection laws equivalent to the highest international standards (such as the UK standards). When we transfer personal data internationally, including to affiliates or third parties, we use appropriate safeguards, including applicable standard contractual clauses or internal data transfer agreements. Please contact us as per section 10 below in the first instance if you would like details of the safeguards we apply in relation to the export of your personal data.

6. Security

WGC has put in place commercially appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. WGC limits access to applicant personal data to those employees, agents, contractors and other third parties who have a business need to know. You are responsible for complying with any security procedures, in connection with the application process, of which you are notified.

7. Data Retention

We will retain your personal data for the period necessary to fulfil the purposes outlined in this Applicant Privacy Notice and to comply with applicable laws, as subject to our Data Retention Policy. If you are successful with your application, your personal data will be kept in accordance with our Staff Privacy Notice which you will be provided with upon being hired. If you are unsuccessful with your application, we will retain your personal data for at least 1 (one) year from the data of confirmation that your application was unsuccessful. Subject to any applicable legal or regulatory obligations, we may delete your personal data from our database without further notice to you.

Our retention periods are based on business needs and we take into account the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

8. Updating your Personal Data

We will use reasonable endeavours to ensure that your personal data is accurate. In order to assist us with this, you should notify us of any changes to your personal data that you have provided to us by contacting us as per section 10 below.

9. Your Data Protection Rights

We operate in countries with data protection laws that may provide certain rights to individuals, including in respect of access, deletion, rectification and limiting processing of personal data.

In general, the following rights are likely available regardless of where an individual is located:

• the right to object to processing for direct marketing purposes; and
• the right to require us to update any inaccuracies in the personal data we hold. In order to assist us with this, please keep the relevant information up to date.

Where we have collected and processed your personal data on the basis of consent, you can withdraw your consent at any time. You should note that withdrawing your consent will not affect the lawfulness of any processing we conducted prior to the withdrawal, nor will it affect the processing of your personal data where we relied on lawful bases other than consent.

If you would like to exercise your rights, you can contact us (see below). When you reach out to us, we will endeavour to respond without delay and in accordance with applicable privacy laws. Further, we reserve the right to check your entitlement prior to answering a request and to ask you to provide clarifications or details as may be needed to establish your identity against your details already available with us. You have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority.

10. Contact Us

It is expected that the HR Team can resolve any query or concern raised about our use of your Personal Data. If you have questions or requests, please feel free to contact us at hr@gold.org. If you are still dissatisfied with our treatment of your personal data or our response to any attempt to exercise the rights as listed above, you have the right to complain to the data protection authority within the jurisdiction in which they are employed or otherwise engaged. Please see the appendices to this Applicant Privacy Notice for details of the relevant data protection authorities in your jurisdiction.

Last Update: August 2026

Appendix 2: Additional EEA, Switzerland and UK specific provisions

If you are located in the EEA, Switzerland or the UK, the provisions of this Appendix 2 apply in addition to the provisions of the Applicant Privacy Notice.

Why do we use your personal data? Who do we share your personal data with and why?

The provisions of this section apply in addition to provisions of the Applicant Privacy Notice. With respect to individuals located in the EEA, Switzerland or the UK, use and disclosure of personal data must be based on one of a number of lawful bases and we are required to set out the lawful bases in respect of each use made of your personal data.

An explanation of the scope of the legal basis available can be found below. These are the principal legal bases that justify our use of your information:

• Contract Performance: where your information is necessary to enter into or perform our contract with you.
• Legal Obligation: where we need to use your personal data to comply with our legal and regulatory obligations.
• Legitimate Interests: where we process your personal data to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights.
• Vital Interests: where we process your personal data to protect your life, generally in circumstances where you incapable of giving your consent.
• Consent: where you have consented to the processing of your personal data for one or more specified purposes. You are free to withdraw your consent by contacting us in accordance with section 11 of the Applicant Privacy Notice. Where you do so, we may be unable to provide a benefit or service that requires the use of such data.

Justifying our use of your special categories of personal data and criminal convictions data

• Employment Obligations: where our legal duties and right as employers require it, or to comply with social security or social protection duties which necessitate personal data processing.
• Vital Interests: processing is necessary to protect the vital interests of you or of another natural person where you are physically or legally incapable of giving consent.
• Legal Claims: where your information is necessary for us to establish, defend, prosecute or make a claim against you, us or a third party.
• Public Interest: processing is necessary for reasons of substantial public interest, on the basis of EEA, Swiss or UK law (as applicable).
• Health Services: to assess your working capacity, assist in making medical diagnoses, occupational health or provision of health/social care and treatment.
• Explicit Consent: we do not need your explicit consent if we use your special category personal data / criminal convictions data in accordance with one or more of the lawful bases set out above. In limited circumstances, we may approach you for your explicit consent to allow us to process special categories of personal data / criminal convictions data for certain processing activities. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us. You are free to withdraw your consent by contacting us in accordance with section 10 of the Applicant Privacy Notice. If you do so, we may be unable to provide a benefit or service that requires the use of such data.

In the list below, we have set out the relevant lawful bases that apply to each purpose for which we use your personal data as described in the Applicant Privacy Notice (including the sharing of your personal data for these purposes as described in the Applicant Privacy Notice).

International transfers of personal data (specifically, transfers outside of the EEA and UK)

The provisions of this section apply in addition to the provisions of the Applicant Privacy Notice. If transfers are made to other countries that are not deemed to provide adequate protections under EEA, Swiss or UK law, we will ensure that such transfer is subject to appropriate safeguards in accordance with applicable data protection laws such as approved standard contractual clauses. You can contact us as per the "Contact Us" section of the Applicant Privacy Notice (with reference to Appendix 1) for further information about the safeguards applied to your personal data.

What are your rights?

In addition to the rights set out in the Applicant Privacy Notice, you may, under certain conditions, have the right to:

• withdraw your consent where you have given your consent to us to use your personal data for certain purposes. You have the right to withdraw this consent at any time by contacting us. This will not affect the lawfulness of any use of your information that we make before you withdraw your consent.
• be provided with details about what personal data we hold about you and to be provided with a copy of your personal data.
• be provided with a copy of the information you have provided to us in a machine-readable format so that you can transfer it to another provider or ask us to transfer this to another data controller (where our processing activity is based on contract performance or consent).
• require us to delete personal data (including where our processing activity is based on your consent or our legitimate interests).
• restrict how we use your personal data whilst a complaint is being investigated.
• object to our processing of your personal data (where our processing is based on our legitimate interests).
• ask us not to reach decisions affecting you using automated processing or profiling.

Additionally, if you are based in France, you have the right to define directives on the processing of your personal data your death in compliance with the French data protection act (law n°78-17 of 6 January 1978 as amended).

Please be aware that certain exceptions apply to the exercise of these rights and so you will not be able to exercise them in all situations. When a request to exercise certain rights in relation to personal data is made, we will need to check the entitlement prior to answering a request.

Any queries or requests in relation to the foregoing should be directed to the HR Team whose details are provided in section 11 of this Applicant Privacy Notice.

If you are not satisfied with how we have addressed your complaint or concerns, you can also contact your appropriate EEA Data Protection Authority (DPA) (https://edpb.europa.eu/about-edpb/about-edpb/members_en). If you are located in the UK, your DPA is the Information Commissioner's Office (www.ico.org.uk).

Appendix 3: Additional India specific provisions

If you are located in India, the provisions of this Appendix 3 apply in addition to the provisions of the Applicant Privacy Notice.

For individuals located in and / or subject to applicable data privacy laws of India, their data protection rights comprise the right to correct, complete, update, delete personal data, request withdrawal of consent, request access to their personal data, request the identities of third parties with whom their personal data has been shared, raise grievances, and nominate an individual on their behalf in case of their incapacity.

Contact us

If you have any questions, about this Appendix 3 or any concerns or grievances about the processing of your personal data, you may contact the HR Team whose details are provided in section 10 of the Applicant Privacy Notice.

Appendix 4: Additional Peoples Republic of China specific provisions

If you are located in the People's Republic of China, the provisions of this Appendix 4 apply in addition to the provisions of the Privacy Notice.

If you are located in mainland China, you have the following rights under the Personal Information Protection Law (PIPL): to be informed of and decide on the processing of your personal information; to access, correct, or delete your personal information; to withdraw your consent at any time; to request an explanation of our processing rules; and to request data portability where legally required. To exercise these rights, please contact us as set out in section 11 of the Applicant Privacy Notice.

Contact us

If you have any questions, about this Appendix 4 or any concerns or grievances about the processing of your personal data, you may contact the HR Team whose details are provided in section 10 of the Applicant Privacy Notice.

Appendix 5: Singapore specific provisions

If you are located in Singapore, the provisions of this Appendix 5 apply in addition to the provisions of the Applicant Privacy Notice. The collection, use and disclosure of personal data in Singapore is governed by the Personal Data Protection Act 2012 ("PDPA").

Consent and bases for processing

We collect, use and disclose your personal data with your consent, or where consent is deemed to have been given by you (for example, where you voluntarily provide personal data to us for an obvious purpose), or where an exception under the PDPA permits us to do so without consent.

International transfers of personal data

The provisions of this section apply in addition to the provisions of the Applicant Privacy Notice. We will not transfer personal data to a country or territory outside Singapore except in accordance with the requirements prescribed under the PDPA i.e., we will ensure that a standard of protection comparable to the protection under the PDPA is provided to the transferred personal data.

What are your rights?

The provisions of this section apply in addition to the provisions of the Applicant Privacy Notice.

At any time, you may:

• Request access to personal data about you that is in our possession or under our control, as well as information about the ways in which your personal data has been or may have been used or disclosed by us within a year before the date of the request. Please note that you may be charged a reasonable fee (for which we will provide a written estimate) for us to process an access request;
• Request correction of any error or omission in the personal data we hold about you. Please note that there may instances where we are not required to correct or otherwise alter your personal data, for example, as set out in the Sixth Schedule of the PDPA; and
• Withdraw your consent to the collection, use or disclosure of your personal data for any purpose by giving us reasonable notice.

To submit a request regarding personal data by email, please contact us using the "Contact Us" section of the Applicant Privacy Notice.

There may be instances where we cannot grant you access to the personal data we hold. For example, we may need to refuse access if granting access would interfere with the privacy of others or if it would result in a breach of confidentiality. If that happens, we will give you written reasons for the refusal.

When contacting us to request access to or correction of any personal data we hold about you, or to withdraw consent in relation to your personal data, we ask that you provide us with as much detail as you can about the data in question as this will help us to retrieve it. Before we provide you with access to your personal data, we may require some proof of identity. Unless we inform you otherwise, we will respond to your request for access or correction within 30 days of receiving your request, and to your withdrawal of consent in relation to your personal data within ten business days of receiving notice.

Contacting us

If you have any questions about this Applicant Privacy Notice, any concerns or a complaint regarding the treatment of your personal data or a possible breach of your privacy, please contact us as per the "Contact Us" section of the Applicant Privacy Notice.

Appendix 6: Japan specific provisions

If you are located in Japan, the provisions of this Appendix 6 apply in addition to the provisions of the Applicant Privacy Notice. In the event of any inconsistency, this Appendix shall prevail to the extent required under the Act on the Protection of Personal Information (Act No.57 of 2003, as amended, "APPI").

Data Controller

The name, address and representative of the data controller handling your personal information are set out in Appendix 1.

Definitions

Personal Data or Personal Information: this means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number (including, "Individual Number" as defined by the "Law on the Use of Specific Numbers to Identify Individuals for Administrative Procedures" (namely, the "My Number Law")), location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; and is defined as "personal information" under the Act on Protection of Personal Information ("APPI") (No. 57 of 2003, as amended).

Purpose of Use of Personal Data (Article 21 APPI)

We will handle your Personal Information in accordance with the APPI.

Your Personal Information will be used only to the extent necessary for the purposes described in this Applicant Privacy Notice. We will not use Personal Information beyond the scope necessary to achieve these purposes except as permitted under applicable laws and regulations.

Collection of Personal Information

We may collect personal information by the following means:

• Directly from you
• Automatically through your use of technology (e.g., cookies, IP address)
• From third parties (e.g., recruitment agencies, references, or background check providers)

Where we obtain your personal information from third parties, we will do so in accordance with APPI and other applicable law and, where required, confirm that such personal information has been lawfully obtained.

Special Care-Required Personal Information (Article 20 APPI)

We will obtain prior consent from the individual before acquiring any Special Care-Required Personal Information (e.g. information relating to health, medical history or other sensitive data), unless an exception under applicable law applies.

Provision of Personal Information to Third Parties

We may provide your personal information to third parties, including group companies and service providers, for the purposes described in this Applicant Privacy Notice.

We will not provide personal information to third parties without your prior consent, except where permitted under applicable laws, including:

• Where required by law
• Where necessary to protect life, body or property
• Where necessary for public health or child welfare
• Where required to cooperate with governmental authorities

Cross-Border Transfers

It is sometimes necessary for us to provide your Personal Data to our other WGC entities or third-party service providers situated out of Japan (including in countries which do not provide the same level of data protection as Japan).

Your Personal Data may be transferred outside Japan only if:

• You have expressly consented that Personal Data can be transferred to a third party outside Japan, unless such Personal Data is transferred to a country in the EU or the UK, the overseas organization to which the Personal Data will be transferred is bound by legally enforceable obligations to provide to the Personal Data transferred a standard of protection that is comparable under the APPI in an appropriate and reasonable manner or the overseas organization to which the Personal Data will be transferred is certified in accordance with an international framework of the handling of Personal Data (including APEC Cross-Border Privacy Rules System).

Information about the foreign organizations to which the Personal Data will be transferred (other than where Personal Data is transferred to the EU or UK) is mainly as follows:

You may request further information regarding such measures, including details of the destination country and the data protection system in that country.

Please refer to an overview of the data protection legal system in relevant jurisdictions through the link of the Personal Information Protection Commission of Japan's website below.

https://www.ppc.go.jp/enforcement/infoprovision/laws/?ref=gnavi

Security Control Measures

We take necessary and appropriate measures to prevent leakage, loss or damage of personal information and to otherwise ensure its security, including:

• Organizational measures (internal policies, responsible persons)
• Human measures (training, confidentiality obligations)
• Physical measures (access controls, secure storage)
• Technical measures (access restrictions, encryption)

Retention Period

We will retain Personal Information only for as long as necessary to achieve the purposes of use.

Where retention periods are prescribed by applicable laws and regulations, such statutory periods will apply.

Rights relating to your Personal Information under APPI

In addition to the rights set out in the Applicant Privacy Notice, you may, under certain conditions, have the right to:

• request notice of the purpose of use
• request access to your Personal Information
• request correction, addition or deletion of your Personal Information where it is inaccurate
• request suspension of use or deletion of your Personal Information where it is handled in violation of applicable law
• request the disclosure of your Personal Information held by us, and the disclosure of the records of the provision of information about you that we have disclosed to third parties
• ask us to cease use of or erase Personal Information in certain circumstances

If you would like to exercise any of these rights, please contact us using the information provided in the section 11 of the Applicant Privacy Notice above and we will endeavour to respond to your request within the timescale prescribed by the APPI.

Contact Us

If you have any questions, requests or complaints regarding the handling of your personal information in Japan, please contact the HR Team using the contact details provided in Section 10 of this Applicant Privacy Notice.

Appendix 7: UAE specific provisions

If you are located in the UAE (onshore), the provisions of this Appendix 8 apply in addition to the provisions of the Privacy Notice.

In addition to the rights set out in the Privacy Notice, you may, under certain conditions, have the right to:

• withdraw your consent where you have given your consent to us to use your personal data for certain purposes. You have the right to withdraw this consent at any time by contacting us using the contact details set out in the "Contact Us" section. This will not affect the lawfulness of any use of your information that we make before you withdraw your consent.
• be provided with details of the information about the processing of your personal data including on the categories of personal data we process in relation to you, the processing purposes and the storage period;
• be provided with a copy of the information you have provided to us in a machine-readable format (where our processing activity is based on contract performance or consent).
• require us to delete personal data (including where our processing activity is based on your consent).
• restrict how we use your personal data whilst a complaint is being investigated.
• object to our processing of your personal data where the processing of your personal data is intended for the purpose of direct marketing, including profiling related to direct marketing, or for the purposes of conducting statistical surveys (unless the processing is necessary to serve the public interest), or is carried out in violation of the principles of applicable data protection law.

Your exercise of these rights is subject to certain exemptions. If you exercise any of these rights, we will check your entitlement and respond in most cases within a month.

If you are not satisfied with how we have addressed your complaint or concerns, you can also contact the UAE Federal Authority for AI and Data.