RECRUITMENT AND JOB APPLICATIONS

DATA PROTECTION NOTICE

PURPOSE AND SCOPE OF NOTICE

This notice is intended to explain how your Personal Data will be handled by the Smurfit WestRock Group (the "Group", "we" and "us") and sets out the information including the personal information detailed below relating to you ("Personal Data") that will be collected and processed by Smurfit WestRock where:

You participate in a Group recruitment initiative.
You voluntarily submit your CV/resume to a representative of the Group on an ad hoc basis;
You apply for an advertised job with the Group;
A recruiter provides your CV/resume to the Group and we arrange a job interview with you.

For the purposes of this notice, the controller of your Personal Data is the Company, Smurfit WestRock. your Personal Data will be under the responsibility of the Group. For more information about the Group, including a full list of entities in the Group, please refer to the Group Internet, (www.smurfitwestrock.com/vHome/com/Locations). The entities within the Group have established procedures in place to ensure that your Personal Data are protected.

This notice applies to any and all job applications submitted, and recruitment initiatives coordinated by the Group. If you have any questions or concerns about this notice, please contact our Data Protection Representative within the legal department of Smurfit Kappa.

IMPORTANT: Where we receive your CV via a recruiter with whom you have engaged with, we encourage you to read the relevant recruiter's data protection notice to understand how your Personal Data is processed by such a recruiter who is a controller of your Personal Data independently of the Group.

APPLICATION OF THIS NOTICE

This notice applies to the way we collect and process your Personal Data from the time you provide Personal Data in an application, up to the point at which you commence employment with us (if at all). Once you commence employment, the way we process your Personal Data will no longer be dealt with under this notice but will instead be governed by our Employee Data Protection Notice (which will be made available to you when you commence your employment with the Group).

WHAT PERSONAL DATA WE PROCESS

As part of the recruitment and job application process, we collect the Personal Data that you submit to us, which may include:

Personal details such as your name, gender, residential address, email address, contact telephone numbers, nationality, marital status, country of birth [or previous criminal convictions]; Note: Criminal background checks may only be carried out in Ireland in limited circumstances where a criminal conviction is relevant to an employee's role and duties (e.g. a person applying to be a driver but s/he has maximum penalty points on his/her license meaning s/he cannot fulfil their role or duties. SKG should review and amend in consideration of whether collection of data relating to previous criminal convictions is appropriate.
Details about your previous employment such as your length of service and your role;
Details about your qualifications such as your skills, education, the languages you speak (including your proficiency), your eligibility to work in a particular country (e.g., your citizenship or visa details), your experience in the job you apply for and other industries;
Details about your preferences such as positions you may be interested in, information about when you may be available to interview and/or start work for the Group (i.e. your current notice period) or work on ongoing basis (e.g. full or part time or on weekends), whether you are open to relocation or working remotely, whether you are willing to travel for work and whether you have your own transport;
Details you may provide us in response to our queries or questions at interview stage (including information about you which we generate throughout the interview and/or recruitment process);
[Details about you which we gather from publically available sources such as the Internet and your social media accounts where such searches are relevant to the job you have applied for within the Group];

and

[If you apply for a position through LinkedIn, we may use the information you have previously provided to LinkedIn to populate your application. We will ask you to authorise LinkedIn to share your personal data with us for this purpose.]

It is necessary for us to process your Personal Data in order to assess your job application and/or include you in a recruitment initiative. Ultimately, it may also be necessary for us to process your Personal Data in order to take steps to offer and enter into a contract of employment with you. In the event that you do not wish to provide us with your Personal Data for the purposes outlined in this notice, we will not be able to assess your job application and/or include you in a recruitment initiative and/or offer you a contract of employment.

Please note that should you include information you think is relevant to your job application or the recruitment initiative, including cover letters, references from your previous employers and other documents that are likely to contain your Personal Data, we will hold and process any such Personal Data in accordance with the terms of this notice.

WHY WE PROCESS YOUR PERSONAL DATA

The following table details the key context for which ("Legal Basis") and why ("Purposes") we collect, obtain and process your Personal Data within the Group. The third parties and those within the Group with whom we may share your Personal Data ("Recipients") are detailed in section 5 (Disclosure of your Personal Data) of this notice.

LEGITIMATE INTERESTS
Legal Basis	We may obtain, collect and process your Personal Data where it is necessary for the purpose of facilitating the recruitment process.
Purposes	We obtain, collect and process your Personal Data: To process your job application, including to contact you in relation to interviews and/or offer you a job after the interview stage; To assess your Personal Data against vacancies which we think may be suitable for you; To verify details you have provided to us using third party sources; To request information from third parties such as qualifications and references; To carry out background checks; To retain your information (should you be unsuccessful) in order to contact you in relation to future vacancies within the Group that may be of interest to you; To maximise the number of potential candidates who are informed about job opportunities; To collect feedback on and evaluate the recruitment process; and To promote internal and external recruitment events.
IMPORTANT	When we process your Personal Data based on our legitimate interests, we make sure to consider and balance any potential impact on you and your data protection rights. We will not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by law). You have a right to object at any time to the processing of your Personal Data where we process your Personal Data on the legal basis of pursuing our legitimate interests.

COMPLIANCE WITH A LEGAL OBLIGATION
Legal Basis	It is necessary to process your Personal Data in order to comply with legal obligations imposed on us as an employer under applicable Irish and European Union law.
Purposes	We obtain, collect and process your Personal Data in order to comply with the following legal obligations: To comply with Irish and European Union employment, equality and health & safety law; To comply with Irish and European Union tax law; and To comply with other applicable Irish and European Union laws.


ASSESSMENT OF YOUR WORKING CAPACITY
Legal Basis	It is necessary to process your Personal Data in order for us to determine your working capacity.
Purposes	We obtain, collect and process your Personal Data: To assess if you are fit to work or not fit to work (e.g., where you have suffered from an illness); To assist you obtain adequate support after/during you have suffered from a health condition which affects your work capacity.

We will only use your Personal Data for the purposes for which we collect it (as outlined in this section 4), unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you in accordance with section 9 of this notice and we will explain the legal basis which allows us to do so.

DISCLOSURE OF PERSONAL DATA

We may disclose some or all of your Personal Data to the following parties:

Internal business units such as Human Resources, IT, Finance/Payroll, Group Managers, system administrators and support staff who have advertised a vacancy within their unit or who will interview you;
Your previous employers where you have provided them as a reference;
Recruitment agencies;
Members and shareholders of the Group;
Outsourced service providers who assist the Group with recruitment initiatives and campaigns;
Professional advisors such as legal advisors, consultants and accountants.

TRANSFER OF YOUR PERSONAL DATA

We may transfer your Personal Data outside the European Economic Area ("EEA") to other members of the Group and other Recipients. Certain Recipients (our third-party service providers and other companies within the Group's group) who process your Personal Data on our behalf may transfer your Personal Data outside the EEA to a country that does not provide an adequate level of protection to your Personal Data. Where such transfers occur, it is our policy that: a) they do not occur without our prior written authority; and b) that an appropriate transfer agreement such as the Model Clause Contracts or other approved transfer mechanisms approved by the European Commission and supervisory authorities (such as the Data Protection Commission is put in place to protect your Personal Data.

RETENTION OF YOUR PERSONAL DATA

Where you are a successful job applicant, the Personal Data generated by us and provided by you over the course of the job application/recruitment process will be retained by us for the purpose of your contract of employment. Such Personal Data will be retained in accordance with our Employee Data Protection Notice and Retention Policy (which will be available to you when you commence employment).

Where you are an unsuccessful job applicant, we will retain your Personal Data for a period of up to 12 months after you attend an interview or submit a job application for the purposes of both contacting you in relation to future vacancies within the Group which we think may be of interest to you and for the purpose of defending potential employment equality claims which you may bring against us.

Please note that in certain circumstances, we may hold your data for a longer period, for example, if we are processing an ongoing claim or believe in good faith that the law or a relevant regulator may reasonably in our view expect or require us to preserve your Personal Data.

YOUR RIGHTS AND HOW TO EXERCISE THEM

You have a number of rights in relation to your Personal Data, which are set out in this section 8. In particular, these rights include the right to object to processing of your Personal Data where that processing is carried out for our legitimate interests. Note that in certain circumstances these rights might not be absolute.

Right	Further Information
Right of Access	You have the right to request a copy of the Personal Data held by us about you and to access the information which we hold about you. We will charge you for making such an access request where we feel your request is unjustified or excessive.
Right to Rectification	You have the right to have any inaccurate Personal Data which we hold about you updated or corrected.
Right to Erasure	In certain circumstances, you may also have your personal information deleted, for example if you exercise your right to object (see below) and we do not have an overriding reason to process your Personal Data or if we no longer require your Personal Data for the purposes as set out in this notice.
Right to Restriction of Processing	You have the right to ask us to restrict processing your Personal Data in certain cases, including if you believe that the Personal Data we hold about you is inaccurate or our use of your information is unlawful. If you validly exercise this right, we will store your Personal Data and will not carry out any other processing until the issue is resolved.
Right to Data Portability	You may request us to provide you with your Personal Data which you have given us in a structured, commonly used and machine-readable format and you may request us to transmit your Personal Data directly to another data controller where this is technically feasible. This right only arises where: (1) we process your Personal Data with your consent or where it is necessary to perform our contract with you; and (2) the processing is carried out by automated means.
Right to Object	You have a right to object at any time to the processing of your Personal Data where we process your Personal Data on the legal basis of pursuing our legitimate interests.

You can exercise any of these rights by submitting a request to our Data Protection Representative in writing.

We will provide you with information on any action taken upon your request in relation to any of these rights without undue delay and at the latest within one month of receiving your request. We may extend this up to two months if necessary having regard to the circumstances of the request. However, we will inform you if this arises.

QUESTIONS REGARDING THIS NOTICE

If you have any concerns about the way your Personal Data are being used or processed by the Group, please contact our[Data Protection Representative at Smurfit WestRock legal team.

If after this, you are not satisfied by the effort and response by the Group, you have the right to lodge a complaint with the Data Protection Commission.

CHANGES TO THIS NOTICE

If we amend this notice, in whole or part, at our sole discretion, any changes will be effective immediately upon notifying the revised notice to you.

If at any time we decide to use your Personal Data in a manner significantly different from that stated in this notice, or otherwise disclosed to you at the time it was collected, we will notify you and you will have a choice as to whether or not we use your Personal Data in the new manner.

If you have questions or concerns about this notice, please contact our Data Protection Representative.