11/18/23, 2:20 PM about:blank

Data Privacy Statement – recruitment

In connection with Vestas’ recruitment process for new employees, we will collect and process your personal
data. This applies both to advertised vacancies for which you apply and where we contact you directly.

Purpose of processing

Vestas Wind Systems A/S (“VWS”), Hedeager 42, DK-8200 Aarhus N, Denmark, reg. no. 10403782 and its
participating corporate entities (each a “Vestas Entity”) and together with Vestas Wind Systems A/S, the
“Vestas Group” or merely “Vestas” will collect and process personal data about you for the Purpose of:

· administering and processing your application – including assessing your qualifications and
competencies with respect of a position

· improve the Vestas recruiting process in form of statistic

· defending Vestas against claims from rejected candidates if needed.

If – and only if – you choose to make your profile visible to “All Vestas recruiters globally”, Vestas will
also be processing your personal data for the purpose of:

· providing you with global employment opportunities according to the area of function you have marked
as area of interest and contacting and corresponding with you regarding your interests in current and/or future
employment within Vestas.

For the above-mentioned reasons, the personal data you provide to Vestas will be processed and protected in
accordance with this Data Privacy Statement.

Although Vestas will process some of your personal data in our internal HR systems if hiring you (contact
information needed to offer you employment and create the relevant documents), this Data Privacy Statement
does not form part of an employment offer or contract. If Vestas makes an employment offer to you, Vestas
will provide further information about the handling of your personal data separately.

Data controller

The legal entity responsible for processing your personal data is the corporation under the Vestas Group with
which you are applying for a job or which contacts you in connection with a recruitment process. The
specific legal entity will be stated in the job advertisement if this concerns an advertised vacancy. In case of
an inquiry from Vestas, the specific legal entity will be clearly stated in the inquiry.

Type of data collected concerning me

Vestas will collect and process the following personal data:

a) Name
b) Email address
c) Telephone number
d) Password
e) Country/Region of residence

f) Area of function you would like to be working within

g) Preferred language
about:blank 1/4
11/18/23, 2:20 PM about:blank

h) Potential jobs applied for and the application(s)

i) Personal information you may choose to contain in your application including Cover letter and CV
(e.g. address, photo, birthday, gender, marital status, educational background, work experience and other
related experience)

j) Cover letter

k) Additional documents uploaded by you in the application process

l) Personal information about you that you have yourself posted e.g. on LinkedIn and similar
websites

m) Information collected as part of the interview process, such as notes taken during your interview,
information provided by recruitment agencies and background check information, such as information
obtained through reference checks and confirmation of your education and employment history

Vestas recommend that you do not provide such data as e.g. health data, racial religious beliefs, political
views or ethnic background, trade union membership and sexual orientation etc. from your application
material (sensitive personal data). Vestas also ask you to cross out any civil registration no. on grade sheets
and other places where your civil registration no. may be stated as Vestas does not need to know this
information in the recruitment process.

Only to the extent you by law are obligated to share health data or other sensitive personal data as part of the
recruitment process (in order to comply with the obligations in the field of employment law), you should
include such sensitive personal data in the application.

Confidentiality

All data will be treated as confidential information and only handled by those who are allowed to process it
and will be used for the Purpose only.

Storage and access

Your personal data will be stored by Vestas in the country where you apply for a position, by Vestas in
Denmark or in the country of the relevant Service Provider engaged by Vestas, e.g. our IT Service Provider,
SuccessFactors by SAP and will be accessed by the Vestas recruiters managing the positions you have
applied for.

If – and only if – you choose to make your profile visible to “All Vestas recruiters globally, your personal
data may be accessed by Vestas Entities worldwide on a need to know basis according to the area of function
you have marked as area of interest.

Transfer of personal data

Vestas may transfer personal data to third parties, including entities within and outside Vestas Group for the
following processing purposes:

· Within Vestas, as Vestas is part of a wider group (Vestas Group), Vestas may transfer the applicant data
to, or otherwise allow access to such data by, other entities within the Vestas Group which may use, transfer
and process the data for the purposes set out in the section “Purpose of processing”.

· Data processors: Where necessary for the processing purposes described in the section “Purpose of
processing”, personal data may be shared with one or more third parties, whether affiliated or unaffiliated, to
process personal data under appropriate instructions ("data processors").

Please be informed that the level of data protection as currently applied and enforced in countries outside the
European Union does not conform to the level of data protection for personal data currently applied and
enforced within the European Union. The transfer of personal data outside the EU/EEA will be based on the
EU Commission’s Standard Contractual Clauses or Binding Corporate Rules, as applicable.
about:blank 2/4
11/18/23, 2:20 PM about:blank

Retention period

Your personal data will be deleted latest six months after the completion of the recruitment process unless
Vestas is required under applicable law to keep your personal data for a shorter or longer period of time.

To the extent you have applied for positions with Vestas in more than one country, we will hold your personal
data for the longest of the retention periods required by local law.

If – and only if – you choose to make your profile visible to “All Vestas recruiters globally” your personal
data will be deleted latest 6 months from your last activity e.g. changes, update of information etc., unless
Vestas is required under applicable law to keep your personal data for a shorter or longer period of time.

Please note that if you are offered and accept a position in Vestas, your profile will remain in the recruitment
system and be kept by Vestas in accordance with this Data Privacy Statement unless you delete it. Please see
the 'Editing your Personal data' section of this Data Privacy Statement for information on deleting your
profile.

If you are offered and accept a position at Vestas, relevant parts of your application material (primarily
application, CV, any exam certificates and diplomas as well as, if applicable, health data of relevance to your
work capacity) may be transferred to your staff folder. Other application material will be erased. Your staff
folder will be erased no later than five years after you have left your position at Vestas.

If your application is rejected or you are not offered employment, we store your personal data for up to six
months after the rejection, after which your personal data are erased.

Rights of the data subject

You can obtain further information on the personal data which Vestas stores and processes about you by
contacting Vestas Data Privacy Director at dataprivacy@vestas.com. Further, you may object to your
personal data being processed or request that your personal data is erased or rectified. If you wish to object to
your personal data being processed or have your data erased or rectified, please contact Vestas Data Privacy
Director at dataprivacy@vestas.com with this message.

If the processing of your personal data is based on your consent, you have the right to withdraw your consent
at any time. Your withdrawal of consent will not affect the lawfulness of the processing of data that precedes
the withdrawal of your consent. You can withdraw your consent by writing to the following email address:
dataprivacy@vestas.com.

You may also have the right to receive, in a structured, commonly used and machine-readable format,
personal data concerning you that you have provided to us, and you may have the right to transmit that data
to another entity. Please contact dataprivacy@vestas.com if you want to use that right.

Further, if you have any complaints about Vestas’ processing of your personal data, you always have the right
to lodge a complaint with the relevant supervisory authority, e.g. the Danish Data Protection Agency
(Datatilsynet).

Legal basis for processing

Vestas only collect and use personal data about you in accordance with applicable laws. For applicants whose
personal data is collected and processed by Vestas affiliates located in the EU/EEA, the legal basis for the
collection and use of personal data is described below.
about:blank 3/4
11/18/23, 2:20 PM about:blank

The legal basis for administering and processing your application is your request for processing your
personal data prior to entering into a contract, Article 6(1)(b) of the General Data Protection Regulation.

To the extent your personal data is being forwarded to Vestas (with your knowledge) form our external
“search agencies”, or if we access data which you have made public yourself, or if Vestas recruiters write
down notes in connection with the recruitment process, our processing of your personal data is based on the
weighing of interest where our legitimate interest is to process and assess your data with a view to any
subsequent employment. Same legal basis and weighing of interest applies if Vestas process personal data
about you if needed to defend Vestas against claims from rejected candidates and when improving the Vestas
recruiting process in form of statistics. It is the assessment of Vestas that this legitimate interest of Vestas to
process your personal data is not overridden by your interest in Vestas processing the data in the above
described situations.

If you by law are obligated to share health data or other sensitive personal data as part of the recruitment
process (in order to comply with the obligations in the field of employment law) the legal basis for the
processing of these sensitive personal data will be compliance with obligations stated by law.

To the extent Vestas performs a background check of you by collecting references in order to evaluate your
candidacy to a position, this will be done by your consent prior to the collection. If you upload a picture in
your application the legal basis for the processing hereof is also your consent.

Furthermore, if – and only if – you choose to make your profile visible to “All Vestas recruiters globally”,
Vestas will be processing your personal data for the Purpose of providing you with global employment
opportunities and contacting and corresponding with you regarding your interests in current and/or future
employment within Vestas based on your voluntary consent that can be withdrawn. This also applies if you
have been rejected to a specific position if you have chosen to be visible to “All Vestas recruiters
globally”.

about:blank 4/4