Job Candidate Privacy Notice

This recruitment privacy notice explains how and why we handle your personal data in the recruitment process.

Alpine Racing Ltd (referred to in this policy as “we”, “us”, ‘our”)

Whiteways Technical Centre,

Enstone,

Chipping Norton,

Oxfordshire,

OX7 4EE

We are registered with the Information Commissioner’s Office as a controller with registration reference Z9284427.

1. Who does this privacy notice apply to?

This notice applies to applicants wishing to apply for a job or internship offered by Alpine Racing Ltd. It does not cover individuals who are already employees of Alpine Racing Ltd, or any contractors post-hire.

2. How can you contact us?

We have appointed a Data Protection Officer (DPO), who can be contacted in the following ways should you have any questions or feedback about the way your data is processed:

Email: dataprotection@alpinef1.com

3. What information do we collect?

• Identity – First name, Surname, address, title, date and place of birth

• Contact – Email Address, telephone number

• Application content – CV, cover letter, work history, qualifications, education history, information contained in your employment references.

• Interviews – Interview notes, communications and scheduling records, offer decision

• Background – Right to work checks and social media checks

When necessary for specific roles, we also perform DBS and background checks which may require us to process criminal record data as a part of this process. We will inform you if this is necessary at the time.

We do not ask for special categories of data (for example, data relating to your health, ethnicity, religion, or sexual orientation) unless you voluntarily provide this to us.

4. How do we collect your information?

We receive most of the data specified above directly from yourself. However, we may also obtain information from:

• Recruitment agencies

• Referees

• Public sources

• DBS check agency

• Social Media

We process your data for the following reasons:

• To assess your application and your ability to hold the proposed position

• To contact you about your application and scheduling interviews

• To meet a legal obligation where necessary

• To perform background checks for specific roles

• To contact you about job or internship opportunities that may be of interest to you (talent pooling)

We rely on the following lawful basis for processing your information:

• Where processing is required to take the necessary steps before entering an employment contract with you, we process your data under Article 6(1)(b) Performance of a Contract.

• Where we have a requirement under law to fulfil, we process your data under Article 6(1)(c) Legal Obligation.

• Where there is a legitimate interest in processing your data, we process your data under Article 6 (1)(f) Legitimate Interests.

• Where we need your permission for future talent pooling, we process your data under Article 6(1)(a) Consent.

5. Who do we share your data with?

We may also share your personal data with other members of our corporate group of companies. When we do share your personal data with them, these entities will also act as controllers of your data.

Additionally, we may sometimes need to make personal data available to other organisations. These may include contracted partners who we have employed to process data on our behalf, or other organisations in which we have a specific purpose to share your information.

Your information will only be shared with third parties for the purposes set out below:

• Government bodies and dispute resolution and law enforcement organisations, including HMRC, other regulators, the police and the courts.

• Our advisors, including accountants, auditors, lawyers and other external professional advisors.

• The Fédération Internationale de l'Automobile (FIA) to meet regulatorty and sporting requirements.

• To share data with third parties in the context of a sale or restructuring exercise.

• Third-party service providers, this may include suppliers providing services relating to the operation of our job applications platform and our website, CCTV, IT infrastructure and other technical services.

6. Do we transfer data outside the UK?

We ensure that whenever your information processed by us or by our suppliers and partners operating outside the UK and EU then this is done with appropriate legal safeguards and is protected against unauthorised access, loss or destruction, unlawful processing and any processing which is inconsistent with the purposes set out in this Privacy Notice.

When we, or one of our suppliers, transfer your personal data outside the UK/EEA, we will ensure that a safeguard recognised by the UK GDPR is used to enable the transfer:

• We may transfer personal data to countries that have been formally recognised as providing an adequate level of protection: The EU Commission’s adequacy decision for the United Kingdom allows transfers from the EEA to the UK without the need for additional safeguards. For transfers from the UK to the EEA, the UK has recognised the EEA as adequate.

• For transfers from the UK to the US, we rely on the UK-US Data Bridge for US organisations self-certified under the Data Privacy Framework.

• Where there is no adequacy decision, we enter into the EU Commission’s standard contractual clauses with the UK addendum. We may also use the UK’s international Data Transfer Addendum (IDTA). This means that the recipient guarantees that the level of protection for your personal data afforded by the GDPR still applies, and that your rights are still protected.

7. How do we keep your information safe?

We will protect your personal data that you have provided to us via appropriate security measures and controls. We implement technical and organisational measures to prevent the loss, misuse or alteration of your personal data. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

All emails are encrypted, and we seek to use third-party technology providers that are ISO27001 certified or equivalent (SOC II) where practical.

Employees, contractors, and approved third parties may only access or process your data on our instructions, and they are required to always maintain confidentiality.

8. How long do we keep your information for?

We will only retain your personal data for as long as is necessary to fulfil the purposes for which it is collected.

If you consent to us keeping your personal data on file to consider you for future vacancies, we will keep your data for a period of two (2) years from the last time we contacted you to offer you positions that match your profile.

In the event of a positive response to your application, your personal data may be transferred to our human resources team to fulfil the legal and regulatory obligations necessary for your hiring and to ensure the administrative management of your file.

9. Automated Decision-Making

We do not make any decisions during the application process using solely automated means.

10. What rights do I have in relation to my data?

You have several rights over your data and to request that we action any of the following.

1. The right to be informed: We will tell you what we are doing with your information.

2. The right of access: You can request a copy of the data we hold on you.

3. The right to rectification: If you think that our records on you are wrong, please let us know. We will correct any factually incorrect information.

4. The right to erasure: In some cases, you can request us to delete your information.

5. The right to restrict processing: You can request us stop using your data for certain purposes.

6. The right to data portability: In some cases, you can ask us for a copy of your data in a format that is machine-readable.

7. The right to object: You can object to some of our processing.

8. Rights in relation to automated decision making and profiling: You can ask us to review any automated decision we have made.

Please note, that some of these rights are not absolute. For further information on your individual rights or to ask any questions please email us at dataprotection@alpinef1.com.

11. Not happy?

Please let us know if you are unhappy with any of the above information regarding the use of your personal data by contacting the Data Protection Officer at the email address listed above. We will acknowledge your complaint within 30 days and investigate and respond without undue delay.

You also have a right to complain to the Information Commissioner’s Office. You can find their contact details at www.ico.org.uk. We would be grateful for the chance to deal with your concerns before you approach the ICO, so please do contact us in the first instance.

12. Updates

This notice will be updated from time to time, and we ask that you check back regularly.

The version number and date released will always be listed below:

Version Number: 1

Last Updated: March 2026