Candidates application privacy notice

Collection and Processing of Personal Data of Candidates Who Apply on the Curium Careers site, including any other platform or processes (such as LinkedIn or other job portals)

This Privacy Notice (hereinafter “Notice”) aims at clarifying what Curium does to ensure the confidentiality and security of your personal data in the context of your job application process as described in Curium website here. Curium encourages you to read this Notice carefully before submitting any personal data to Curium.

Curium’s [California Employee, Contractor, and Applicant Privacy Policy ] and [Notice at Collection] apply to residents of California who apply on the Curium Careers site, including any other platform or processes (such as LinkedIn or other job portals).

Curium (“we”, “us” “our”), as the data controller, aims to provide you with information about what personal data we collect, the reasons for which we collect it, how we treat it, from which sources we collect it, the purposes for which we use these, to whom we can transfer it, how we keep it secure and where you can get information about the personal data Curium processes during the recruitment process, under applicable data protection laws (hereinafter referred to as “Applicable Data Protection Laws”). If you apply via a third-party platform (e.g., LinkedIn), the parties owning these platforms may also access your personal data through your personal profiles and will also act as data controllers independently from Curium.

This Notice applies exclusively to the personal data of job applicants, prospective candidates for employment, individuals referred for job opportunities, and participants in Curium’s optional recruiting programs and events. It does not apply to personal data relating to Curium employees, contractors, clients, or data collected by Curium for other purposes.

For the purposes of this Notice, “personal data” refers to information that identifies job applicants or potential candidates for employment with Curium, whether submitted through Curium’s online application portal or through other channels such as recruitment agencies, social media platforms, or directly via our HR email address (hr@curiumpharma.com).

Your personal data will be processed in accordance with the terms of this Notice. In the event of any conflict between this Notice and the Applicable Data Protection Laws, the provisions of the latter shall prevail.

For what purposes Curium processes your personal data?

Curium processes your personal data for recruitment process that includes, inter alia, a response to your application for employment and communication with you during your recruitment process. We also process the personal data in connection with the assessment of your application for a specific position and the information you provide Curium in this frame.
Our website and the job portals with which Curium cooperates allow you to upload or share attachments related to your application for a specific position. You provide Curium with these attachments voluntarily, and personal data contained therein will be processed only for the purposes described in this Notice.

Curium processes personal data to evaluate your experience, qualifications, and suitability for employment opportunities. This may include conducting background or reference checks where applicable, corresponding with you throughout the recruitment process, maintaining records related to hiring activities, and fulfilling applicable legal or regulatory obligations.

Additionally, Curium may analyze personal or de-identified/anonymized data to assess and improve the effectiveness of our recruitment efforts and to support our talent acquisition strategies. Please note that to the extent that Curium relies on AI powered tools to support the recruitment process, decisions are not being made solely through automated processing and include meaningful human involvement.

Which personal data does Curium process?

When you apply to work with Curium, Curium will likely collect and store all or part of the following personal data or categories of personal data. For the avoidance of doubt, this list is not exhaustive:

• First name, last name
• Academic title
• Permanent residence, temporary residence
• Country of citizenship
• Date and place of birth
• Native language
• Phone number
• E-mail address
• Education
• Information listed in the attachment of your Curium application / request / demand for any job listingWork experience / information on previous employment
• Evidence at the employment office
  Photographs (if you provide them to Curium as an attachment to your CV)

Personal data may be collected from the following sources:

• Directly from you as an applicant, by creating an account and signing up to apply for a career opportunity through Curium’s website;
• Third-party recruitment firms, which provide similar data;
• References you have named, including previous employers; and
• Publicly accessible professional networking sites (e.g., LinkedIn) directly from the candidates.

The type of personal data Curium requests and how Curium handles it are guided by the legal and procedural requirements of the country where the job is based, rather than your country of residence. If a role is available in multiple locations or if you apply for positions in more than one jurisdiction, the personal data Curium collects, and processes will align with the applicable requirements of each relevant country.

You may decide not to provide your personal data to Curium. However, failure to provide this information will potentially affect the evaluation of your application and your inclusion in the recruitment process.

Where required or permitted under local laws, Curium may also collect sensitive personal data, as defined under Applicable Data Protection Laws, including, but not limited to, information about your medical condition, racial/ethnic origin, and/or disabilities. Curium recommends that candidates avoid including any sensitive personal data in their application unless explicitly requested. If you voluntarily disclose such sensitive personal data, it will be handled in accordance with relevant Applicable Data Protection Laws and Curium’s internal policies.

Legal basis for Curium to process your personal data?

Curium processes your personal data for recruitment purposes based on one or more of the following lawful grounds:

• Your consent – for example, when contacting you or sharing your information as part of pre-employment screening, where such consent is required.
• Our legitimate interests – such as evaluating your suitability for a role and managing the recruitment process;
• Compliance with legal obligations – including requirements related to immigration or employment law.

If Curium relies on your consent to process your data, you have the right to withdraw it at any time. Details on how to exercise this right can be found in the section titled “What are the candidates’ rights?”.

For how long does Curium keep your personal data?

Curium only processes personal data for the period that is necessary for the purpose for which Curium is processing it. Curium continuously assesses whether the need to process certain personal data for certain purposes is still valid. When Curium finds that your data is no longer necessary for any of the purposes for which it was processed, Curium securely destroys it in accordance with our data retention procedures.
It is Curium’s responsibility to discard data within a maximum of two (2) years for unsuccessful candidates for a particular position, subject to shorter statutory limits under local law, so that Curium can protect both your rights and its rights and legitimate interests in case of any dispute relating to admission to employment. If your application is successful, the personal data provided during the recruitment process will be moved to your employee file and processed in line with Curium’s Employee Privacy Notice. If Curium intends to keep your personal data beyond the retention period mentioned above (for example, to consider you for future employment opportunities) Curium will reach out to you separately to request your explicit consent.

To whom does Curium transfer your personal data with?

Curium may transfer candidates’ personal data to external vendors, acting on behalf and under Curium’s instructions, who assist in the recruitment process by assessing job applications. Curium may also engage third-party recruitment agencies. Where you apply through such an agency, your CV and other application details will be shared with Curium by the nominated agency in the country where you apply to work (which may differ from the country where you currently reside). Curium will process the personal data received from these agencies in accordance with this Notice. For information about how the agency handles your personal data, please review its privacy notice or contact the agency directly.

Curium maintains procedures to help ensure that any third-party service providers handling personal data do so in accordance with this Notice and Curium’s online Privacy Statement available here.
As Curium operates globally, your personal data may be transferred to and stored in countries other than your country of residence.

• If you are an EU or UK resident: Where Curium transfers personal data outside the European Economic Area (EEA) or the United Kingdom (UK), Curium does so in compliance with the General Data Protection Regulation (GDPR) and the UK GDPR. Such transfers rely on adequate safeguards permitted by regulators for transfers outside of the EEA or the UK, including but not limited to adequacy decisions, the European Commission and UK standard contractual clauses and, where required, supplementary measures to ensure that your personal data is protected to the standard required under Applicable Data Protection Laws.
• If you are a US resident: Transfers of personal data are carried out in compliance with applicable US federal and state privacy laws. Where Curium transfers your personal data outside of the United States, Curium will implement reasonable and appropriate legal, technical and organizational security measures, with the aim to ensure the security of the processing and in particular to protect your personal data from unauthorized access, use or disclosure.
• If you are a resident of another jurisdiction: Curium will comply with the data transfer and data protection requirements applicable under the laws of your country of residence. Where international transfers occur, Curium will implement reasonable and appropriate legal, technical and organizational security measures to ensure your personal data remains protected in line with local legal requirements.

What are the candidates’ rights?
Under Applicable Data Protection Laws, you have a number of rights which you can exercise as a data subject, including the right of access, correction, restriction of processing, deletion, objection, portability or the right to withdraw your consent. You also have the right to lodge a complaint with the supervisory authority in your country of residence. These rights may differ depending on the data protection laws of your country of residence.

You may exercise your rights directly through Curium’s Data Protection Officer (DPO) reachable at: privacy.office@curiumpharma.com. Curium may ask you to provide details or evidence to confirm your identity as well as information about your interactions with Curium in order to manage your request.

Contact information

Should you have any questions regarding the processing of your personal data and Curium’s commitment to privacy, please read our online Privacy Statement, or if you require any further information, contact Curium’s DPO reachable at the following email address: privacy.office@curiumpharma.com.

Curium may update this Notice from time to time. Any revisions will be published on this page, and Curium encourages you to review it periodically to stay informed about how Curium handles your personal data during the recruitment process.

Last Updated: September 2025