Consent Declaration and Privacy Statement – RecruIT

Privacy Statement – RecruIT

Introduction

At Novo Nordisk (“Novo Nordisk” or “Us” or “Our” or “We”), We strive to make a difference and improve
the lives of millions of people affected by diabetes and other illnesses around the world. Being an industry
leader in Corporate Social Responsibility, We respect and value your personal privacy.

We want you – the Candidate – to understand who We are, what information We will collect from you, and
how We process your personal data. We created this Privacy Statement (“Privacy Statement”) to provide
you with greater transparency into Our privacy practices and principles and to inform you – the Candidate
– of your individual rights.

To that end, We also want you to understand that each Novo Nordisk entity complies with all applicable
privacy laws and regulations in their respective locations. This means that you – the Candidate – may
have different privacy rights depending on the specific job you apply and the specific Novo Nordisk
affiliate processing your personal data.

This Privacy Statement is, therefore, divided into three separate categories:

A. General Privacy Rights, which sets forth Candidate privacy rights that apply to Our entire
organization, regardless of location (the ‘General Rights’);
B. the Privacy Rights of Candidates applying for jobs located in the European Economic Area
(‘EEA’) and
C. United States Privacy Rights, which sets forth Candidate privacy rights that apply only to Novo
Nordisk entities operating in the United States (‘US Rights’).

We ask that you read this Privacy Statement carefully and indicate your acceptance of its terms by
following the prompts at the end of this document. For purposes of this document for EU/EEA countries
and all non-United States jurisdictions, Our processing of your personal data will be based on legitimate
business purposes and necessary for the performance of a contract as the legal basis. For the United
States, the processing of personal data is based on consent.

If you do not accept Our processing of your personal data, We cannot process your application.

A. GENERAL RIGHTS – Applicable to ALL Candidates

1. Who We Are
 1a. Who We Are (positions in all countries except the United States)

The company responsible for processing your personal data is:

Novo Nordisk A/S
Novo Allé
2880 Bagsværd
Denmark
CVR number 24256790
+45 4444 8888

We share your personal data with the specific Novo Nordisk entity that you are applying
for and that Novo Nordisk Entity is to be considered a data controller.

We only share your personal data with other Novo Nordisk entities when you opt-in to
sharing your personal data with another Novo Nordisk entity for the purpose of
recruitment then that NN entity is to be considered a data controller.

You can always contact Novo Nordisk A/S, the specific Novo Nordisk entity receiving
your job application or the Novo Nordisk Data Privacy Officer
at privacy@novonordisk.com with questions or concerns about how We process your
personal data.

1b. Who We Are (positions in the United States)

The company responsible for processing your personal data is:

Novo Nordisk Inc.
800 Scudders Mill Road
Plainsboro, New Jersey 08536 USA
+1 855 411 5290

You can always contact the specific Novo Nordisk entity receiving your job application by
e-mailing the Novo Nordisk Privacy Counsel at NNIPrivacy@novonordisk.com with
questions or concerns about how We process your personal data.

2. Personal Data Held by Novo Nordisk

Novo Nordisk collects personal data submitted by you as part of the recruitment process.
Personal data is held on an externally hosted database in the Netherlands.
 Further, your personal data, if necessary, for the below purposes, will be transferred to
third parties providing products and services (such as agencies assisting Novo Nordisk in
screening and interviewing prospective employees and recruitment process vendors) and IT
system suppliers, as well as regulatory authorities if required by law. When these are acting as
data processors, contractual agreements are put in place to safeguard your personal data.

Personal data is also held in manual form and on other internal computer systems. Personal data
includes all information submitted by you.

3. Purposes for Which Personal Data is Held by Novo Nordisk

As part of the recruitment process, your personal data may be transferred to Novo Nordisk
entities located in a different country from your country of residence.

By setting a Candidate Profile, personal data will be used and shared for the following purposes
depending on which visibility level you chose when you filled in your Candidate Profile:

 If your Candidate Profile is visible to Novo Nordisk recruiters globally: If you have made
your Candidate Profile visible to Novo Nordisk recruiters globally, it will be possible for all Novo
Nordisk recruiters globally to look up your Profile in Our online recruiting system and use it for
general recruitment purposes. The application you have sent for the specific requisition will
only be visible for the Novo Nordisk recruiters and administrative employees handling this.
They are not necessarily placed in the Novo Nordisk entity where you have applied for a
position and in that situation your personal data will be transferred to other Novo Nordisk
entities.
 If your Candidate Profile is visible to Novo Nordisk recruiters in your country of
residence: If you have made your Candidate Profile visible for Novo Nordisk recruiters in your
country of residence, it will only be possible for Novo Nordisk recruiters in that country to look
up your Profile in Our online recruiting system. The application you have sent for the specific
requisition will only be visible for the Novo Nordisk recruiters and administrative employees
handling this. They are not necessarily placed in the Novo Nordisk entity where you have
applied for a position and in that situation your personal data will be transferred to other Novo
Nordisk entities.
 If your Candidate Profile is visible to Novo Nordisk recruiters handling the requisition you
have applied for: If you have made your Candidate Profile visible for Novo Nordisk recruiters
handling the specific requisition you have applied for, it will only be possible for them to look up
your Profile in Our online recruiting system. The application you have sent for the specific
requisition will be visible for the Novo Nordisk recruiters and administrative employees handling
this. They are not necessarily placed in the Novo Nordisk entity where you have applied for a
position and in that situation your personal data will be transferred to other Novo Nordisk
entities.

If you apply for a role and/or are invited to an interview, We collect further information that will be
visible to the recruiter and the recruiting team handling the application.

When submitting your Profile and application to Novo Nordisk, you certify that all of your personal
data entered in the profile and application process and system is true and correct, and you
 understand that dishonesty will disqualify you from consideration for employment with Novo
Nordisk.

If you are offered and hired for a position in Novo Nordisk, as part of the hiring process, your
personal data will be processed in accordance with the requirements of the country for which you
are hired and the laws and requirements that govern that country.

4. What Personal Data We Process About You

To facilitate applications on vacant positions, process and select and initiate hiring, We collect
information in Our talent acquisition systems, which contain:

 Contact information (name, address, telephone number, e-mail address)

 CV or resume, including work experience, qualifications, skills, and education history
 Job-specific or demographic data as required for reporting requirements

In the interest of maintaining the safety and security of Our customers, employees and property,
Novo Nordisk will perform a background verification check on you in connection with your
employment application and in accordance with local requirements.

The background verification check is conducted by an external vendor and contain information
concerning your character and include, but is not limited to, Satisfactory references, verification of
curriculum vitae, confirmation of academic and professional qualifications, independent identity
check and criminal records.

You will be asked for specific consent before the background verification check is initiated.
However, by consenting to Novo Nordisk to process your job application, you consent to Novo
Nordisk to send basic information to Our external vendor, who will contact you regarding the
check.

We collect and process personally identifiable information to meet legal, regulatory and
compliance requirements specific to the country you have applied. You are not required to
provide Us with your personal data. However, if you do not provide your personal data, We will
not be able to handle your job application.

5. Disclosure of Personal Data

As a general matter, your personal data will be disclosed only in limited circumstances. Personal
data will be disclosed to the extent required for the purposes listed in this Section A above to
Novo Nordisk entities globally, including affiliates located in countries other than where you
reside. These locations may have different data privacy and protection laws and regulations from
your country of residence.
 Additionally, your personal data will be disclosed to external vendors as described in section A1,
public authorities and law enforcement agencies as required or permitted by all applicable laws or
further explained in Sections B and C.

6. Storage and Deletion of Data

We ask you to provide accurate and up-to-date information and encourage you to regularly
update your personal data in the Candidate Profile, where you also can request deletion. You
may review and modify your Candidate Profile information or request deletion of it at any time.
However, please know that storage and deletion of your job application data will be done in
accordance with the applicable laws and regulations governing the Novo Nordisk entity where
you’ve applied.

Unless outlined below, applications for all entities that use the platform, including those in the
European Economic Area (‘EEA’), will be maintained for or approximately six (6) months after the
end of the recruitment process. Candidate Profiles will be anonymized after one (1) year of
inactivity. Some countries have longer retention periods, as stated below.

Country of Position Application Retention Period Post Hiring Process

Ending

United States 4 years

South Korea 4 years

Indonesia 3 years

If you are selected and hired for a position to which you have applied, your applicant data is
currently retained beyond the retention periods above to support the hiring process. Information
collected upon application is transferred into the employee system of record. Additionally, your
resume and application will be retained.

7. Your Rights

As indicated above, Novo Nordisk values the importance of your personal data that it collects
from you and strives to give you as much control over it as possible.

As such, you are entitled to receive further information on the personal data We store and
process about you. You are also entitled to request that Novo Nordisk delete or correct any
inaccurate personal data that We store about you. Additionally, you – the Candidate – are entitled
to additional data subject rights depending on where you have submitted your job application. We
ask you to review Sections B or C, whichever applies to your specific application, to better
understand your individual privacy rights.
 Please note that you reserve the right to withdraw your consent to our processing of your
personal data at any time. Novo Nordisk will always honor this request for any future processing
but will not be able to modify any previous processing of personal data done before you revoked
your consent. You may still have additional rights regarding the storage and retention of your data
based on applicable data privacy and protection laws governing the various Novo Nordisk
entities. Those rights are set forth in Sections B and C.

8. Statistics

Your personal data will be used in anonymous and aggregated form for internal purposes only,
including, but not limited to, statistical analysis.

B. GDPR RIGHTS – Candidates Applying for a Position in EU/EEA

As We indicated above, you – the Candidate – are entitled to specific rights under applicable data privacy
and protection laws that apply to all Novo Nordisk entities subject to the General Data Protection
Regulation (the ‘GDPR’). As an applicant to a GDPR-covered Novo Nordisk entity, you are entitled to
Section A and Section B rights only.

1. Who We Are

The company responsible for processing your personal data is:

Novo Nordisk A/S
Novo Allé
2880 Bagsværd
Denmark
CVR number 24256790
+45 4444 8888

We share your personal data with the specific Novo Nordisk entity that you are applying for and
that Novo Nordisk Entity is to be considered a data controller.

We only share your personal data with other Novo Nordisk entities when you opt-in to sharing
your personal data with another Novo Nordisk entity for the purpose of recruitment then that NN
entity is to be considered a data controller.

You can always contact Novo Nordisk A/S, the specific Novo Nordisk entity receiving your job
application or the Novo Nordisk Data Privacy Officer at privacy@novonordisk.com with questions
or concerns about how We process your personal data.
 To get the specific contact information for the specific Novo Nordisk entity receiving your job
application, please visit Our corporate directory: https://www.novonordisk.com/about-novo-
nordisk/worldmap.html. You can also get more general information regarding Novo Nordisk’s
privacy policies and practices by visiting: https://www.novonordisk.com/utils/disclaimer.html.

2. Disclosure of Personal Data

We informed you above in Section A that We will disclose your personal data under limited
circumstances. If your personal data must be transferred outside of the EEA, then We will rely on
certain safeguards, as required by the GDPR and permitted by applicable laws, to protect your
personal data depending on where it is being transferred. Those safeguards are as follows:

 Transfer is to a Novo Nordisk entity covered by Novo Nordisk’s Binding Corporate Rules,
available at https://www.novonordisk.com/about-novo-nordisk/corporate-governance/personal-
data-protection.html;
 The destination countries are deemed by the EU Commission to have an adequate level of
protection of personal data.
 We have entered into EU Commissions Standard Contractual Clauses for the Transfer of
Personal Data to Third Countries. You can get a copy of the Clauses by contacting Us as
described in Section 1.

3. What Personal Data We Process About You

In addition to Section A on General Rights, a background verification check is performed for some
positions in the EU/EEA. By clicking “accept” that you have read and understood this privacy
notice, you also consent to Novo Nordisk sending basic information such as your name and e-
mail address to Our external vendor, who will contact you regarding the check.

4. Your Data Subject Rights

As noted above, you can always obtain further information on the personal data We store and
process about you to the extent you have such right under applicable law.

Under the GDPR, you can exercise the rights indicated therein and in particular:

 Right to withdraw - you have the right to withdraw your consent at any time (Article 7(3)). Your
withdrawal will not affect the lawfulness of the processing carried out before you withdrew your
consent. You may withdraw your consent for a specific service by following the instructions for
the specific service, see specific service website.
 Right of access – you have the right to obtain confirmation as to whether or not personal data
concerning yourself are being processed and, where that is the case, to obtain information, in
particular about: the purposes of the processing, the categories of personal data processed
and the period of storage, the recipients to whom the personal data may be disclosed (Article
15 of GDPR);
  Right to rectification – you have the right to obtain, without undue delay, the rectification of
inaccurate personal data concerning yourself and to have incomplete personal data completed
(Article 16 of GDPR);
 Right to erasure – you have the right to obtain, without undue delay, the erasure of your
personal data, in the circumstances envisaged by GDPR (Article 17 of GDPR);
 Right to restriction of processing – you have the right to obtain from Us the restriction of
processing in the circumstances envisaged by GDPR (Article 18 of GDPR);
 Right to data portability – you have the right to receive the personal data concerning yourself
which you have provided to Us in a structured, commonly used and machine-readable format,
and to have those data transmitted to another controller without hindrance, in the
circumstances envisaged by GDPR (Article 20 of GDPR);
 Right to object – you have the right to object to processing of personal data concerning yourself,
unless legitimate grounds for Us continuing the processing exist (Article 21 of GDPR);
 Right to file a complaint with the Authority – you have the right to file a complaint to the Data
Protection Authority. You may always lodge a complaint with a data protection supervisory
authority in the EU/EEA member state of your habitual residence, place of work or where the
alleged infringement has taken place. You can find the list of EU Data Protection
Authorities here.

If you wish to exercise one or more of your rights, please contact Us

at privacy@novonordisk.com.

C. UNITED STATES RIGHTS – For Candidates Applying for a Position in the United
States

As We indicated above, you – the Candidate – are entitled to specific rights under applicable data privacy
and protection laws that apply to all Novo Nordisk entities subject to the United States (hereafter, the
“US”). You are entitled to Section A and Section C rights as an applicant to a US-covered Novo Nordisk
entity.

1. Who We Are

The company responsible for processing your personal data is:

Novo Nordisk Inc.
800 Scudders Mill Road
Plainsboro, New Jersey 08536 USA
+1 855 411 5290

You can always contact the specific Novo Nordisk entity receiving your job application by e-
mailing the Novo Nordisk Privacy Counsel at NNIPrivacy@novonordisk.com with questions or
concerns about how We process your personal data.

To obtain the specific contact information for the specific US Novo Nordisk entity receiving your
job application, please feel to visit Our corporate directory located
 at: https://www.novonordisk.com/about-novo-nordisk/worldmap.html. You can also obtain more
general information regarding US Novo Nordisk’s privacy policies and practices by
visiting http://www.novonordisk-us.com/disclaimer-privacy.html.

2. Your Consent

As stated in Section A above, We ask that you carefully read this Privacy Statement before you
click the acceptance button below (‘I understand and agree to the above terms’).

If you do not accept the terms in the Statement, you will not be able to create a Candidate Profile
on this website. If you accept the terms and create your Candidate Profile, you also understand
and agree that your personal data will be stored outside of the US and will be subject to the data
privacy and protection laws and regulations governing US Novo Nordisk entities.

If you provide Us with personal data that contains sensitive information, such as information
relating to race, color, sex, gender identity, sexual orientation, disability, veteran status, or other
similar types of information, you expressly authorize Novo Nordisk to handle such information in a
confidential manner related to analyses of applicant’s demographics.

Any information you submit through the Career Site must be true, complete, and not misleading.
Submitting inaccurate, incomplete, or misleading information will lead to a rejection of your
application during the application process or disciplinary action, including immediate termination
of employment. In addition, it is your responsibility to ensure that the information you submit does
not violate any third party’s rights.

If you provide Us with personal data of a reference or any other individual as part of your
application, it is your responsibility to obtain consent from that individual prior to providing the
information to Us.

3. Personal Data Collected from Other Sources

Novo Nordisk will obtain personal data about you from your references or from a background
check report in connection with your application, as permitted by applicable law as defined in
Section A Sub-Section 3.

4. Use of Personal Data

The information that you submit on Our Career Site will be used for Novo Nordisk’s global
personnel recruitment, management, and planning purposes, as permitted by local law, including
to:

 assess your capabilities and qualifications for a job;

  provide you updates/notifications about opportunities that match your capabilities and
qualifications;
 process a job application;
 conduct reference checks;
 respond to your queries and communicate with you about your application, and send you
information regarding the Career Site and changes to Our terms and policies;
 comply with or monitor compliance with any applicable law or regulation; and
 conduct background checks if We offer you a position.

Novo Nordisk will also use the data as We believe to be necessary or appropriate:
(a) under applicable law, including laws outside your country of residence;
(b) to comply with legal process;
(c) to respond to requests from public and government authorities including public and
government authorities outside your country of residence;
(d) to enforce Our terms and conditions;
(e) to protect Our operations or those of any of Our affiliates;
(f) to protect Our rights, privacy, safety, or property, and/or that of Our affiliates, you, or others;
and
(g) to allow Us to pursue available remedies or limit the damages that We sustain.

We will also use the data in anonymized and/or aggregated form to analyze trends relating to
responses to job postings and for statistics and reporting purposes.

5. Disclosure of Personal Data

Novo Nordisk will share personal data with affiliates involved in evaluating candidates for a given
position. Novo Nordisk will remain responsible for personal data jointly used with affiliates. We will
make the data available to personnel with a business need to know the information, including
personnel in the recruiting, human resources and information technology departments and the
department responsible for the position you are applying for. Novo Nordisk will share personal
data with Our third-party service providers, such as hosting and operating Our Career Site,
recruiting assistance, background check processing and similar services.

As indicated above, Novo Nordisk also will share personal data as We believe it to be necessary
or appropriate:
(a) under applicable law, including laws outside your country of residence;
(b) to comply with legal process;
(c) to respond to requests from public and government authorities including public and
government authorities outside your country of residence;
(d) to enforce Our terms and conditions;
(e) to protect Our operations or those of any of Our affiliates;
 (f) to protect Our rights, privacy, safety, or property, and/or that of Our affiliates, you or others;
and
(g) to allow Us to pursue available remedies or limit the damages We sustain, Novo Nordisk will
transfer data to a third party in the event of any reorganization, merger, sale, joint venture,
assignment, transfer or other disposition of all or any portion of Our business or assets (including
in connection with any bankruptcy or similar proceedings).

6. Data Retention

Novo Nordisk will retain personal data for the period necessary to fulfil the purposes outlined in
this Statement unless a longer retention period is required or permitted by law. We will also retain
your data to consider whether your skills are suitable for other opportunities, in which case We
would invite you to apply. Novo Nordisk will remove personal data for inactive accounts from Our
database, subject to applicable legal or regulatory obligations. Furthermore, Novo Nordisk will
delete personal data about you (including your CV/resume) from Our database at any time and
without providing any reason. Therefore, please retain a copy of your personal data.

7. Cookies and Similar Technology

Our service providers and We will use ‘cookies’ and similar technologies on this Career Site.
Please see Our Privacy Statement on Our main website for more information and available
at https://www.novonordisk-us.com/disclaimer-privacy.html.

8. Exercising Consumer Rights Related to Personal Data

If you register on the Career Site, you can access, review and change your personal data stored
on the Career Site by logging in and updating your account information. The updated Profile
should be used as the default the next time you apply for a job using your account online. We
encourage you to promptly update your personal data if it changes or is inaccurate.

Apart from your Profile information, you may request access to and deletion of the personal data
We collect or its modification or suppression, where permitted by applicable law. Please fill out
the following web form with any such requests. In your request, please make clear what personal
data you would like to access or have changed, whether you would like to have personal data
that you have provided to Us suppressed from Our database or otherwise let Us know what
limitations you would like to put on Our use of your personal data. For your protection, We will
only implement requests with respect to the information associated with the particular e-mail
address that you use to send Us your request, and We will need to verify your identity before
implementing your request. We will try to comply with your request as soon as reasonably
practicable as required by law. Please note that certain personal data will be exempt from such
access and deletion rights pursuant to applicable laws and regulations.

9. Data Security
 Novo Nordisk implements organizational, technical, and administrative measures to protect
personal data within Our organization. Unfortunately, no data transmission or storage system can
be guaranteed to be 100% secure. If you have reason to believe that your interaction with Us is
no longer secure (for example, if you feel that the security of any account you might have with Us
has been compromised), please immediately notify Us of the problem by contacting Us in
accordance with the “Contact Us” Section above.

Do not send sensitive data to Us via e-mail. It is your sole responsibility to use the appropriate
level of care whenever you communicate with Us.

10. Links to Third-Party Websites

This Career Site contains links to other websites. This Privacy Statement does not address, and
We are not responsible for, the privacy, data, or other practices of any third parties, including any
third party operating any website or service to which this Career Site links. The inclusion of a link
on this Career Site does not imply endorsement of the linked site or service by Novo Nordisk or
Our affiliates. We encourage you to read the legal notices posted on those sites, including their
privacy policies.

11. About Children

This Career Site is not intended for minors under the age of 18.

FOR CANDIDATES APPLYING FOR A POSITION IN THE US: Please click ACCEPT and
proceed if you accept this Privacy Statement. You are under no obligation to accept
these terms, but if you do not, then please click DECLINE and thereafter, please leave the
page.

FOR CANDIDATES IN THE EU/EEA AND OTHER NON-US COUNTRIES: Please click
ACCEPT and proceed if you accept this Privacy Statement. If not, please click DECLINE
and thereafter, please leave the page.