Privacy Policy for Diepeveen & Partners Employer Branding and Recruitment

Date of publication: 8 September 2026

Diepeveen & Partners Korlátolt Felelősségű Társaság ("Diepeveen & Partners", "we", "us") manages its employer branding and recruitment process through its career site (the "Career Site"), using TeamTailor as its applicant tracking system and website provider.

This privacy policy explains how we process your personal data if:

• You visit our Career Site (you being a "Visitor");

• You connect with us via our Career Site to create a profile with us and receive information about current or future vacancies (you being a "Connecting Candidate");

• You apply for a position with us, via our Career Site or a third-party service (you being an "Applying Candidate");

• We collect information about you from other parties, sites and services, because we believe your profile is of interest for a current or future vacancy (you being a "Sourced Candidate");

• We receive information about you from our employees or partners, because they believe your profile is of interest for a current or future vacancy (you being a "Referred Candidate"); or

• We receive information about you from a Candidate who lists you as their reference (you being a "Reference").

This privacy policy also describes what rights you have when we process your personal data, and how you can exercise them.

When we use the term "Candidate" below, we mean each of Connecting Candidates, Applying Candidates, Sourced Candidates and Referred Candidates, unless stated otherwise.

1. About the processing of personal data

Personal data is any information that can be directly or indirectly linked to a living, identifiable person — for example, a name, e-mail address, telephone number or IP address. Processing of personal data is any use of personal data, such as collecting, recording, storing, sharing or deleting it.

The main law that applies to our processing of your personal data is Regulation (EU) 2016/679 (the "GDPR").

We are the data controller for the personal data described in this privacy policy — we decide for which purposes, and by which means, your personal data is processed. Some of the service providers named in Section 5 below act as our data processors: they process personal data only on our documented instructions, and may not use it for their own purposes.

We have assessed that, given the scale and nature of our processing activities, the appointment of a Data Protection Officer is not mandatory under Article 37 of the GDPR. Queries about this notice or our processing of your personal data can be directed to the contact named in Section 10 below.

Please refrain from including special categories of personal data (such as data concerning health, religious or philosophical beliefs, trade union membership, sexual orientation, or racial or ethnic origin) in your CV or application unless this is necessary for the application process. Where you voluntarily provide such data, it will only be processed where permitted under Article 9 of the GDPR.

2. What personal data do we process?

All individuals

• Device information — if you visit our Career Site, we collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings.

• Technical and statistical data — if you visit our Career Site, we collect technical and statistical data about your use of it, such as which pages you visit and your activity on the site.

• Communications data — we collect and store your communications with us, including their content (e.g. emails, messages, information you add to your account, survey responses).

• Contact details — such as your name, email address, telephone number and physical address.

Candidates

• Application information — such as your CV, cover letter, work samples, education, and, where relevant to a specific vacancy, your strengths and weaknesses, your reasons for wanting to change jobs, your expectations regarding the role, your wage demand, and — if you choose to provide it — details of your current employment relevant to a new role (e.g. notice period, non-compete restrictions).

• Interview and assessment data — such as interview notes, interviewer assessments, candidate evaluation reports, and the results of any tests carried out during the recruitment process.

• Information from your public profile — meaning information we collect about you from publicly available sources related to your professional experience, such as LinkedIn or your current employer's website.

• Information provided by references — meaning information we receive from our employees or partners who refer you to us, or from the persons you list as your references.

References

• Your name and contact details, and the information you provide to us about the Candidate for whom you act as a reference.

3. Where do we receive your personal data from?

All individuals

• From the Career Site — if you visit it, we collect technical and statistical information about your use of it, and information from your device.

• Directly from you — most of the information we process, we receive directly from you, for example when you apply for a position or connect with us. You can always choose not to provide certain information, but some personal data is necessary for us to process your application or provide the information you request.

References

• From the Candidate for whom you are a reference — if a Candidate lists you as a reference, we collect your contact details from them so we can get in touch with you.

Candidates

• From public sources — we may collect personal data about you from sources such as LinkedIn or your current employer's website.

• From our employees or recruitment partners — when they believe your profile is of interest for a current or future vacancy (see Section 5 for the specific partners we work with).

• From your own references, if you provide them to us.

• Data we create ourselves, or together with you — such as interview notes and assessments made during the recruitment process.

Where we collect your personal data from a source other than you directly, we will inform you of this, together with the categories of data concerned and the source, in accordance with Article 14 of the GDPR.

4. For what purposes, and on what legal basis, do we process your personal data?

Personal data is processed lawfully under the GDPR only where a specific legal basis applies. Below, we set out each purpose together with its legal basis and the individuals it applies to.

Reviewing your CV and considering you for a specific vacancy (Applying Candidates) Legal basis: your consent. Your application can only be considered and forwarded by us if you consent to the processing of the data in your CV in relation to that vacancy, and to its transfer within our recruitment process. If we receive your CV from our client (a prospective employer) rather than directly from you, we will inform you of this.

Conducting job interviews with you for a specific vacancy (Applying Candidates) Legal basis: your consent. This includes taking interview notes, preparing assessments and evaluation reports, and — only where we have told you in advance and you have separately agreed — recording the interview.

Identifying job opportunities matching your profile, contacting you about them, and maintaining your registration as a jobseeker (Connecting Candidates; Applying Candidates who are not offered the vacancy they applied for and who wish to remain registered with us) Legal basis: your consent. Where you are not offered a position you applied for, we will only continue to consider you for other opportunities if you separately consent to this.

Initially identifying and reaching out to you based on your public professional profile or a referral (Sourced Candidates; Referred Candidates) Legal basis: our legitimate interest in identifying suitably qualified candidates for our current or future vacancies. Once you respond and engage with us, any further processing of your data for matching and registration purposes is based on your consent, as described above.

Reviewing your CV and profile, and communicating with you about it (Connecting Candidates; Applying Candidates) Legal basis: your consent.

Using artificial intelligence (AI) tools to help review and match candidates to job opportunities We may use AI tools to analyse the information in your CV and profile, to help identify candidates whose skills and experience align with a role. AI assists in the initial screening process only — all decisions concerning candidate assessments and recommendations are subject to human review by our team, and no automated decisions are made based solely on AI analysis. Candidate data processed by these tools is not used to train any public or third-party AI models. If the use of these tools meaningfully influences a decision concerning you, you may request further information about the logic involved and its likely consequences, using the contact details in Section 10.

Maintaining contact with your employer, and performing our contractual obligations towards them (contact persons at client companies) Legal basis: our legitimate interest, and that of the relevant client company, in maintaining the business relationship. Upon request, we will provide further information about the legitimate interest assessment balancing our interests against your rights and freedoms.

Contacting you to ask you to provide information about a Candidate, and evaluating that information (References) Legal basis: our legitimate interest in carrying out a thorough recruitment process.

Contacting Candidates to ask for participation in surveys (Candidates) Legal basis: your consent, as part of the consent described above for maintaining your registration with us.

Protecting and enforcing our rights, interests, and the interests of others (all individuals, where relevant to a legal issue) Legal basis: our legitimate interest in being able to establish, exercise or defend legal claims.

Sharing your personal data with the recipients described in Section 5 Legal basis: as described in Section 5 and above, depending on the purpose of the sharing.

Operating, securing, maintaining and improving the Career Site, including through cookies and similar technologies (Visitors) Legal basis: our legitimate interest in the security and performance of the Career Site, or your consent where required for non-essential cookies (see our separate Cookie Policy).

5. Whom do we share your personal data with?

We only share your personal data with recipients we have carefully selected and, where required, entered into data processing agreements with.

• TeamTailor (TeamTailor AB, Östgötagatan 16, 116 21 Stockholm, Sweden), as the supplier of our Career Site and applicant tracking system, acting as our data processor.

• IMEX Global Kft. (seat: 2360 Gyál, Vecsési út 94), as our system administrator, acting as our data processor.

• UNIQUE IMG Bt. (seat: 9932 Viszák, Fő út 56.), as our hosting provider, acting as our data processor.

• Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), as our cloud-based service provider. We use Microsoft 365, including Microsoft 365 Copilot, under contract with Microsoft Ireland Operations Limited. Microsoft stores and processes Microsoft 365 customer data within the EU/EFTA under Microsoft's EU Data Boundary programme. Limited residual transfers outside the EU/EFTA may still occur for specific purposes such as cybersecurity threat monitoring, abuse prevention and technical support, and Copilot's underlying AI processing may, during periods of high demand, occur outside the EU/EFTA depending on our configuration of Microsoft's "Flex Routing" setting (data at rest remains within the EU Data Boundary regardless of this setting). Any such transfers are governed by Microsoft's Data Processing Addendum, relying on the EU-U.S. Data Privacy Framework and, as a backstop, the European Commission's Standard Contractual Clauses.

• Our recruitment consultants — Kolb Consulting Kft (seat: 1181 Budapest, Reviczky Gyula utca 59. IX. em. 140. ajtó), Tiszeker Ügyvédi Iroda (seat: 1025 Budapest, Özgida u. 15/9.), S&K Human-Logistics Korlátolt Felelősségű Társaság (seat: 1161 Budapest, Szent Korona utca 16-18. 2. em. 12), and Minik Emese (sole proprietor, seat: 2760 Nagykáta, Szondy utca 8.) — who act exclusively on our instructions as our data processors, and do not determine the purposes or means of processing your personal data, or use it for their own business purposes.

• Our client companies, as prospective employers, when you consent to your application being forwarded to them for a specific vacancy.

• Companies providing cookies on the Career Site, where you consent to this — see our separate Cookie Policy for details.

• Authorities and other public actors, when we have a legal obligation to share your data with them.

• Parties involved in legal proceedings, where needed to protect or defend our rights (for example, in the case of a discrimination claim).

• Other parties involved in a merger, acquisition, financing, or sale of company assets, should such a transaction occur.

6. When do we transfer your personal data outside the EU/EEA, and how do we protect it?

We store and process your personal data within the EU/EEA wherever possible. Where a recipient named in Section 5 processes data outside the EU/EEA (as described for Microsoft above, or where a client company is located outside the EU/EEA and you have consented to your data being shared with them), we ensure that a safeguard recognised by the GDPR is in place, such as:

• an adequacy decision by the European Commission (including the EU-U.S. Data Privacy Framework and the UK adequacy decision); or

• the European Commission's Standard Contractual Clauses.

You may request further details of these safeguards, or a copy of the relevant documentation, using the contact details in Section 10.

7. For how long do we keep your personal data?

All individuals — where we process your personal data to protect or enforce our rights, we keep it until the relevant legal issue is fully and finally resolved.

Visitors — we keep device and technical data for one (1) year for security purposes. Cookie retention periods are set out in our Cookie Policy.

Applying Candidates — we process your personal data until the application process for the relevant vacancy is closed. If you are successful, we process your personal data for a maximum of one year following your placement. If you are not successful but consent to remain registered with us (see Section 4), your data is then processed for a maximum of 36 months from the date your consent is given, or until you withdraw it, whichever is earlier — before this period expires, we will contact you to ask whether you wish to renew your consent, and if you do not, your data will be permanently deleted or anonymised.

Connecting, Sourced and Referred Candidates — once you have consented to being registered with us, we process your personal data for a maximum of 36 months from the date consent is given, on the same renewal basis described above. Where we have identified you as a Sourced or Referred Candidate but have not yet made contact or received a response from you, we keep the relevant data only for as long as reasonably needed to make that initial contact.

References — we keep your personal data for as long as we keep the personal data of the Candidate for whom you act as a reference.

Contact persons at client companies — we process your data for a maximum of one year after you cease to be the relevant contact person.

8. What rights do you have, and how can you exercise them?

Some of the rights below only apply to processing carried out on a particular legal basis, as noted.

If you want to exercise any of these rights, please contact us using the details in Section 10.

Right to be informed — you have the right to be informed about how we process your personal data, including if we intend to process it for a new purpose. This policy, together with any updates and our responses to your questions, fulfils this right.

Right of access — you have the right to know whether we process personal data about you, and to receive a copy of it, along with information about how it is processed. Further copies may be subject to a reasonable administrative fee.

Right to rectification — you have the right to have inaccurate personal data corrected, and incomplete data completed.

Right to erasure ("right to be forgotten") — you have the right to have your personal data deleted where, for example, it is no longer necessary for the purpose it was collected for, you withdraw your consent, or you have validly objected to the processing.

Right to restriction of processing — you can ask us to restrict processing while we assess a challenge to the accuracy of your data, or in other circumstances set out in Article 18 of the GDPR. While restricted, we will (other than storing it) only process the data with your consent, or for the establishment, exercise or defence of legal claims, to protect another person's rights, or for an important public interest.

Right to object — where our processing is based on our legitimate interest, you may object on grounds relating to your particular situation. We will then assess, on a case-by-case basis, whether we have compelling legitimate grounds that override your interests, rights and freedoms, or whether the processing is necessary for the establishment, exercise or defence of legal claims, and inform you of the outcome.

Right to withdraw consent — where our processing is based on your consent, you may withdraw it at any time, separately for each purpose you consented to. This does not affect the lawfulness of processing carried out before you withdrew consent.

Right to data portability — for personal data we process based on your consent or the performance of a contract, you have the right to receive that data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, including directly by us where technically feasible.

Right to lodge a complaint — you may lodge a complaint with the Hungarian National Data Protection and Freedom of Information Authority (NAIH): 1055 Budapest, Falk Miksa utca 9-11; telephone: +36 1 391 1400; fax: +36 1 391 1410; www.naih.hu; ugyfelszolgalat@naih.hu. You may also lodge a complaint with the supervisory authority in your own EU member state, or, if you are based in the UK, with the Information Commissioner's Office.

Right to judicial remedy — you have the right to a judicial remedy if you consider your rights under the GDPR have been infringed, before the courts of the Member State where we are established, or where you have your habitual residence.

We will respond to your request without undue delay and within one month of receipt; this may be extended by a further two months where necessary, in which case we will inform you within the first month, together with the reasons for the extension.

9. Where can you turn with comments or questions?

If you want to exercise any of your rights, or have questions, comments or concerns about how we handle your personal data, please contact Mr. Frido Cornelis Diepeveen, via email at frido.diepeveen@diepeveenpartners.com or by mail at 1007 Budapest, Danubius Grand Hotel Margitsziget. If you request verbal information (e.g. by phone), we will need to verify your identity first, and minutes will be taken of the conversation.

10. Updates to this Privacy Policy

We update this privacy policy when necessary — for example, if we start processing your personal data in a new way, want to make the information clearer, or need to comply with a change in applicable data protection law. We encourage you to check this page regularly; the date at the top shows when it was last updated.