Candidate Privacy Notice

Your personal data is processed by ON RISING, TI PORTUGAL, LDA., trading as Velv ("Velv", "we", "us", "our"), a company incorporated under Portuguese law, with registered office at Calçada da Estrela 93A, 1200-662, Lisbon, Portugal, and taxpayer number (NIPC) 514280174, acting as the data controller within the meaning of Regulation (EU) 2016/679 (the "GDPR").

This Notice explains how we process personal data submitted when you apply for a role at Velv, including through the application form you are redirected to from our Careers page. It applies in addition to, not instead of, our general Privacy Policy, which covers other interactions with velv.pt.

Depending on how you apply, we may collect:

• Identification and contact details: name, email address, phone number, and any address you choose to provide.
• CV/résumé content: education, work experience, skills, certifications, and language proficiency.
• Cover letter and any other information you choose to include in your application.
• Details generated during the recruitment process, such as interview notes or assessment results, where applicable.

Please do not include special categories of personal data (e.g., health, religious beliefs, trade union membership) in your application unless specifically requested and relevant to the role.

• Assessing your application and carrying out the recruitment and selection process for the role you applied to, based on the performance of pre-contractual steps taken at your request.
• Considering you for future opportunities, if you apply spontaneously or ask us to keep your data for that purpose, based on your consent, which you can withdraw at any time.
• Complying with legal and regulatory obligations relating to recruitment, based on compliance with a legal obligation.

Velv does not use automated decision-making or profiling — such as automated CV screening or scoring — that produces legal or similarly significant effects on candidates. All recruitment decisions involve human review.

We may share your data with:

• Velv personnel involved in the hiring process for the role you applied to.
• Our applicant tracking platform, used to manage and store applications on our behalf; the platform provider does not have independent access to the content of your application, and when Velv deletes your data, the deletion is permanent.
• Professional advisors, where necessary to obtain legal or compliance advice.
• Public authorities, where required by law.

Our applicant tracking platform may process data outside the European Economic Area (EEA), or belongs to a corporate group headquartered outside the EEA. Where this occurs, the transfer is carried out under an adequacy decision issued by the European Commission, the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission, as applicable. You can request more information about the specific safeguard used by contacting us as set out in Section 11.

We keep your application data for up to 2 years from the date of your application, unless you ask us to delete it sooner, in which case we will do so unless we have a legal reason to keep it for longer. If you are hired, your data will instead be kept and processed in accordance with our employee data retention rules, which are set out separately.

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), in certain circumstances
• Restrict the processing of your data, in certain circumstances
• Object to processing based on our legitimate interest
• Data portability, where processing is based on consent and carried out by automated means
• Withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal
• Lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or with the supervisory authority of your country of residence.

Providing the personal data requested in the application form is voluntary. However, without it, we may not be able to assess your application or consider you for the role.

To exercise any of your rights, or for any question about this Notice, please contact us by email at legal@velv.pt.

We may update this Notice from time to time to reflect feedback, changes to our recruitment process, or new legal requirements. If such changes are significant, we will notify you through a notice on this page.

Your trust is important to us — please do not hesitate to contact us with any questions, using the details above.