PARAMOUNT RECRUITMENT PRIVACY NOTICE

This Recruitment Privacy Notice (“Notice”) describes how Paramount Global and its subsidiaries (“Paramount,” “we,” “us,” “our”)¹, collect, use and disclose certain information about applicants for employment and other individuals who apply to work or provide services to us, either directly or through our casting and production company partners. While this Notice is global in nature, our goal is to meet the requirements in each country where applicants are located.

If you accept an offer from us, we will process further information from you in your capacity as an employee or contractor. We will provide you with a full workplace privacy notice as part of the onboarding process.

Please also note that we will comply with all applicable local laws in relation to processing your personal information and if anything in this Notice conflicts with such local laws, those local laws will take precedence.

For the avoidance of doubt however, nothing in this Notice is intended to create an employment relationship between Paramount and any non-employee and does not create contractual rights or obligations. 

This Notice does not apply when you interact with our services as a consumer or visitor to Paramount products and services. To learn about our information practices when you are a consumer, you can review our privacy policies available on Paramount branded properties.

Trust is a cornerstone of our mission at Paramount. We are committed to gaining and maintaining your trust by following a core set of privacy principles:

• Transparency – We will tell you what information we collect about you and how we use it.
• Access – When possible, and when required by law, we will provide you with access to the information that we collect about you.
• Security – We will protect your information with reasonable security measures.
• Accountability – We will take responsibility for the secure processing of your information and do our best to address any concerns or questions that you have about how we process your information.

Click on each header below for more information or scroll down to read the full Notice.

GENERAL INFORMATION FOR APPLICANTS

What Personal Information We Collect About You & Why We Use It

Where the Personal Information Comes From

Retaining Your Personal Information

Who We Share Your Personal Information With & Why

Protecting Your Information

Changes to this Notice

Contact Us

ADDITIONAL INFORMATION FOR APPLICANTS LOCATED OUTSIDE OF THE UNITED STATES

Who is the Data Controller of Your Personal Data

Legal Grounds for Processing Personal Data

Processing Special Personal Data

Further Information on the Personal Data we Process and Our Purposes

Sharing Your Personal Data Outside the Group Companies

Access to Your Personal Data and Other Rights

International Transfers

INTERNATIONAL SUPPLEMENTS

GENERAL INFORMATION FOR APPLICANTS

What Personal Information We Collect About You & Why We Use It

Paramount collects a variety of information about you, which we use to support the recruiting and onboarding process. For purposes of this Notice, we refer to this information as “personal information” or “personal data” (each as defined under applicable law). Below, we list categories of the personal information we may collect and the purposes for which we may use it.

• Contact Information, such as your full name, email address, mailing address, phone number, emergency contact information, and next of kin.
• Demographic Information and/or Protected Classifications, such as your age, gender, racial and ethnic or national origin, disability, veteran status. These may be protected characteristics under applicable law and are used as part of our diversity initiatives and in accordance with applicable law.
• Professional and Employment-Related Information, such as work history, educational background, language skills, and any other information you submit to us, and our assessment of it.
• Identity Verification Information such as your date of birth, age, and social security information or other government-issued identification number.
• Visa Status related to whether you currently or will need us to sponsor you for an employment visa.
• Audio and Video Recordings, such as CCTV images upon attendance for an interview or pursuant to virtual live and/or pre-recorded interviews. If you are seeking a role on a scripted or unscripted program, we may also obtain audio or video recordings from, for example, audition videos.
• Information from Background Checks, as consistent with applicable law.
• Information on Your Proposed Salary, Expected Bonus, and Other Compensation (as applicable), and other terms of your proposed employment or other contractual relationship.
• Information Concerning your Health or Disability, as necessary and consistent with applicable law.
• AnyOther Information You Provide Us, including information relevant or potentially relevant to a dispute or legal proceeding affecting us.

We may use the personal information we collect for a variety of legitimate business purposes in connection with the recruitment process and as follows, such as:

• To assess your qualifications, suitability, and eligibility for a position as an employee or contractor, and terms of any offer.
• To enter into a contract or employment relationship with you (if you are made an offer), to onboard you, and to make working arrangements such as place of work and hours.
• Contacting you or others on your behalf (such as using your emergency contact information in the event of an emergency).
• Contacting references or other individuals who may provide information to us about your employment history or fitness for employment or contract work with us.
• Financial planning and budgeting.
• Payroll and benefits administration, including compliance screenings.
• Physical and system security (such as with your CCTV images from attendance at an interview).
• Providing information about your offer, contract, or terms of employment to third parties in connection with transactions, such as a prospective purchaser, seller, or outsourcer.
• Diversity and equal opportunity initiatives.
• To protect the rights and property of the Company, comply with our legal obligations, and defend or pursue any legal proceedings affecting us.
• Providing a safe workplace.
• Providing reasonable workplace accommodations.
• Staffing decisions.

We may use each of the categories of personal information we collect for any of the uses described above, as warranted.

Where the Personal Information Comes From

Most personal information comes directly from you or your representatives or third parties authorized by you when you apply for a job with us. For example, contact details, information on your immigration status and whether you can lawfully work. We will, where necessary and as set out in this Notice, also require references and information to carry out background checks (where permitted under applicable law), including information on your credit or criminal history. This may include gathering information from third parties.

Further, we may receive personal information relating to you from other sources, such as public social media profiles.

Retaining Your Personal Information

Although there is no specific period for which we will keep your personal data, we will not keep it for longer than is necessary for our purposes. In general, if you become employed by us, we will keep your personal data for the duration of your employment and for a period afterwards. If you are unsuccessful in gaining employment with us, we will likely keep your personal data for a short period after informing you that your application was unsuccessful. In considering how long to keep your data, we will take into account its relevance to our business and your potential employment or relationship with us either as a record or in the event of a legal claim.

If your personal data is only useful for a short period (for example, CCTV images), we will delete it in accordance with our retention policies.

Personal data relating to job applicants (other than the person who is successful) will normally be deleted after 12 months, although please note this will be governed by local applicable retention periods.

Who We Share Your Personal Information With & Why

We may share personal information within the Paramount family of companies. We may share personal information we collect about you with the Paramount family of companies and Paramount personnel for the purposes described in this Notice. This includes to relevant managers, HR, and other administrators for the purposes of reviewing your application and as mentioned herein. We will also disclose this to other members of our group companies where necessary for decision making regarding your application – this will depend on the type of role you are applying for.

We may share your personal information in connection with a corporate transaction. As noted above, we may disclose or transfer your personal information as part of, or during negotiations for, any purchase, sale, lease, merger, or any other type of acquisition, disposal, or financing involving our brands. Any sharing of personal data in connection with a corporate transaction will always be subject to a customary confidentiality agreement between the parties.

We may share personal information with third parties who perform services on our behalf or that are necessary for our business purposes. We may share your personal information with unaffiliated third parties or individuals we hire or work with that provide us with professional advice, business support, perform services on our behalf or in connection with carrying out our business. Examples of these third parties include payroll and benefit service providers, insurers vendors, and information technology providers (this would normally occur if you accept an offer from us and would be carried out as part of the on-boarding process); third party recruitment consultants (and/or third party recruitment portals that we may use from time to time) and other similar businesses that we interact with as part of the recruitment process; external recipients of electronic communications (such as emails); law enforcement agencies, other government authorities (such as tax and employment) and regulators (where required under applicable law); professional advisors such as lawyers and accountants; and background check providers as part of the recruitment process.

We may share personal information if we think we have to in order to comply with the law or to protect ourselves. For example, we will share personal information when it is necessary for us to comply with applicable law or legal process, to respond to legal claims, or to protect our rights or the property or personal safety of our applicants, employees, or the public.

We may share your personal information for reasons not described in this Notice. We will tell you before we do this if reasonably practicable.

Protecting Your Information

We use reasonable security measures. We are committed to protecting your personal information. We have adopted commercially reasonable technical, administrative, and physical security procedures to help protect your personal information from loss, misuse, unauthorized access, and alteration. Please note that no data transmission or storage can be guaranteed to be 100% secure. We want you to feel confident in our processing of your personal information, but we cannot ensure or warrant the security of any information you transmit to us.

Changes to this Notice

From time to time, we may change this Notice to accommodate new technologies, industry practices, regulatory requirements, or for other purposes.

Contact Us

If you have any questions about this Notice, you may contact us through at EmployeePrivacy@viacomcbs.com.

ADDITIONAL INFORMATION FOR APPLICANTS LOCATED OUTSIDE OF THE UNITED STATES

If you are located outside the US, including in the European Economic Area (EEA), United Kingdom (the UK), and Switzerland, the following additional information applies to you, except as otherwise noted in the INTERNATIONAL SUPPLEMENTS.

Who is the Data Controller of Your Personal Data

The entity set out in the International Supplement for your jurisdiction will be a data controller of your personal data (as defined under applicable law). In many cases our US and UK entities (including Paramount Global) will also be data controllers of your personal data, as well as other Paramount entities with whom your personal data is shared from time to time, and as set out in this Notice.

Legal Grounds for Processing Personal Data

Under applicable data protection law, there are various grounds on which we can rely when processing your personal data. In some contexts, more than one ground applies. The grounds for processing are as follows:

• Contract: this is processing necessary for performance of a contract with you or to take steps at your request to enter a contract. This covers carrying out our contractual duties and exercising our contractual rights.
• Legal Obligation: this is processing necessary to comply with our legal obligations. The processing is necessary for ensuring we perform our legal and regulatory obligations. For example, providing a safe place of work, complying with health and safety laws, or avoiding unlawful discrimination.
• Legitimate Interest: this is processing necessary for our or a third party’s legitimate interests. We or a third party have legitimate interests in carrying on, managing, and administering our respective businesses effectively and properly and in connection with those interests processing your data. Where we rely on legitimate interests, we consider:

1. what our legitimate interest is – these are set out in the table below;
2. whether the processing is necessary to achieve it (i.e. whether it is proportionate); and
3. whether it can be balanced against individuals’ interests, rights, and freedoms (via the protections described in this Notice).

Where this test is not met, we do not rely on legitimate interest. This Notice serves as a record of our legitimate interest assessment.

• Consent: this is where you have given specific consent to processing your personal data. In the UK and EU, processing of your data in connection with employment is generally not conditional on your consent. But there may be occasions where we do specific things for which we require your consent. In certain jurisdictions we will ask for consent as the basis for processing certain of your personal data.

Additional legal bases may apply in your jurisdiction.

Processing Special Personal Data

Where necessary in your jurisdiction, if we process special personal data about you (for example, processing personal data relating to diversity monitoring) we will also make sure that one or more of the grounds for processing special personal data applies. Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sexual orientation, sex life, trade union membership and genetic and biometric data are subject to special protection and considered by certain privacy law, including EU privacy law, to be “special” or “sensitive” personal data. Data relating to criminal records or offences is treated in a similar way and, for purposes of this Notice, included in this definition. In some jurisdictions a different term may be used to describe data warranting special protection. However, the remainder of this Notice uses the term “special” personal data for ease.

In outline, these additional grounds for processing include:

• Processing being necessary for the purposes of your or our obligations and rights in relation to employment in so far as it is authorised by law or collective agreement;

• Processing relating to personal data about you that you have made public;

• Processing being necessary for the purpose of establishing, making, or defending legal claims;

• Processing being necessary for provision of health care or treatment, medical diagnosis, and assessment of your working capacity; and

• Processing based on us having received your explicit consent (although please note as set out above that, in general, processing of your personal data in connection with employment is not conditional on your consent in the EU or UK).

 

Further Information on the Personal Data we Process and Our Purposes

Examples of the personal data and the grounds on which we process your personal data are described in the table below. Although these examples represent a comprehensive description of the processing we engage, this list is not exhaustive.

PurposeExamples of personal data that may be processedGrounds for processingRecruitmentStandard personal data related to your identity (e.g. your name, address, email address, ID information and documents, telephone numbers, place of birth, nationality, contact details, professional experience and education (including university degrees, academic records, professional licenses, memberships and certifications, awards and achievements, and current and previous employment details), financial information (including current salary information provided permitted by applicable law) language skills, and any other personal data that you present us with as part of your application related to the fulfilment of the role.

We may also collect and process information concerning your application and our assessment of it including any background checks we may make to verify information provided and any information connected with your right to work. This may include as necessary for your role (and subject to legislation in your jurisdiction) checks verifying your job history, qualifications and previous renumeration as well as credit, criminal record, social media, and adverse media checks. Such data processing will be subject to applicable local law.

If necessary, we will also process information concerning your health, any disability and any proposed adjustments to the recruitment process or working arrangements.

• Contract

• Legal obligation

• Legitimate interest: recruitment

Entering into a contract with you (if you are made an offer by us)Information on your terms of employment including your hours and working patterns, your pay and benefits such as your participation in pension arrangements, any life and medical insurance, and any bonus or share schemes.

• Contract

• Legal obligation

• Legitimate interest: to have an accurate record of your employment contract for its performance and variation

Contacting you or others on your behalfYour address, email address and phone number, emergency contact information and information on your next of kin.

• Contract

• Legitimate interest: the ability to contact you, and others on your behalf in an emergency

Payroll & benefits administrationInformation on your bank account, pension contributions (if relevant) and on tax and social insurance, including tax contribution rate; your social insurance number or other government issued identifier, name and date of birth for compliance check purposes.

• Contract

• Legal obligation

• Legitimate interest: the ability to carry out payroll, general HR, and business administration in an efficient manner, and to plan around your absence where necessary

Financial planning and budgetingInformation such as your proposed salary and (if applicable) envisaged bonus levels.

• Legitimate interest: the ability to carry out effective financial planning and budgeting for our business

Meeting our duty of care and health and safety responsibilities in relation to Covid-19 (or similar health pandemic)

We have a duty of care to ensure a safe place of work, as well as a duty of care to employees. For this reason, where reasonable and necessary, we may do one or more of the following in relation to Covid-19 (or similar health pandemic):

• request information about whether you have had symptoms of the virus, close contact with confirmed cases or travelled to high risk areas, whether you would be considered clinically vulnerable or clinically extremely vulnerable, and whether you have been vaccinated;
• conduct temperature checks before allowing entrance to our premises; and
• ask you to be PCR or Antibody tested before allowing entrance to our premises.

Such data processing will be subject to applicable local law. More information can be found in our Return to Workplace Privacy Notice.

• Legal obligation

• Legitimate interest: to ensure a safe place of work and the safety of our staff

Physical and worksite securityCCTV images upon attendance for an interview:

• Legitimate interest: the ability to keep our locations secure, and provide a safe environment for our personnel; pursuant to any potential legal and/or insurance claims

Facilitating remote interviewsLive and/or recorded video or photographic images of you or your voice; details about participations in and use of video conferencing tools.

• Legal obligation

• Legitimate interest: to facilitate home and remote interviews

Monitoring of diversity and equal opportunitiesInformation on your nationality, racial and ethnic origin, gender, sexual orientation, religion, disability, and age as part of diversity monitoring initiatives. Such personal data will be aggregated and used for equality of opportunity monitoring purposes. Please note we may share aggregated and anonymised diversity statistics with regulators if formally required / requested.

Such monitoring will be subject to applicable local law.

• Legal obligation

• Legitimate interest: to promote diversity and inclusion

Disputes and legal proceedingsAny information relevant or potentially relevant to a potential or actual dispute or legal proceeding affecting us

• Legal obligation

• Legitimate interest: the ability to respond to and defend against legal claims

Legal, regulatory and compliance purposesInformation we process for legal or regulatory purposes (including upholding your data rights under privacy legislation).

• Legal obligation

• Legitimate interest: the ability to comply with relevant law and regulatory guidance

Please note that if you accept an offer from us, the business will process further information as part of the employment relationship. We will provide you with our a fully workplace privacy notice as part of the on-boarding process.

Sharing Your Personal Data Outside the Group Companies

We will only disclose your personal data outside our group companies if disclosure is consistent with a ground for processing on which we rely and doing so is lawful and fair to you.

We will disclose your personal data if it is necessary for our legitimate interests as an organization or the interests of a third party (but we will not do this if these interests are over-ridden by your interests and rights in particular to privacy). We may also disclose your personal data if you consent, where we are required to do so by law and in connection with criminal or regulatory investigations.

Access to Your Personal Data and Other Rights

We try to be as open as we reasonably can about personal data that we process. If you would like specific information, just ask us. Subject to applicable laws in your jurisdiction, you may have certain rights on your personal data, which may include:

• The right to request access to and/or a copy of the personal data we hold about you, including details as to how we process this personal data;
• The right to object to or restrict our processing of your personal data;
• The right to request that your personal data be erased from further use;
• The right to correct, amend, or update personal data you have given us (in some instances, such as on our internal employee portals, you can also do this by logging in and updating your personal data);
• The right of portability, which allows you to request that we share your personal data with others;
• The right not to be subject to automated decision making i.e. a decision made solely by automated processing; and
• If we have relied on consent as a ground for processing, the right to withdraw consent at any time – though if you do so that will not affect the lawfulness of what we have done before you withdraw consent.

To make a request, you should contact us at EmployeePrivacy@viacomcbs.com and set out the nature of your request. The regulator in your jurisdiction may have produced forms to assist you in making a request – where this is the case you can attach these to your email. If you make a subject access request, we may require you to provide information from which we can confirm your identity. Please note that, while we will carefully assess every request we receive, your rights may differ according to your place of residence and we may not always be required to comply. If we do not comply with your request, we will explain why.

If you have any unresolved privacy concerns that we have not addressed satisfactorily after contacting us, you may have the right to contact your local data protection authority.

International Transfers

In connection with our business and for employment, administrative, management and legal purposes, we will where necessary transfer your personal data across country borders in accordance with applicable law. Such transfers include to members of our group of companies and third-party service providers, including in the US and in other jurisdictions in which we are established. For example, some of the systems that we use in connection with our business and your application (such as our recruiting platform) are hosted in the US. We will ensure that any transfer is lawful, including putting in place legal safeguards and ensuring that there are appropriate security arrangements. More specifically, (i) for transfers outside the EEA / UK, this includes entering into the relevant official European or UK Standard Contractual Clauses for transfers to third countries with Paramount group entities and third parties located outside the EEA / UK and, where necessary, implementing further measures to ensure the personal information is subject to equivalent local protection; (ii) for transfers outside of Argentina, we will enter into the applicable official Argentina Model Clauses with Paramount group entities, and third parties located outside Argentina when necessary; and (iiI) for transfers outside of certain other jurisdictions, where required by applicable law, we apply the substantive requirements of the official European or UK Standard Contractual Clauses.

If you want further details of any of these safeguards or agreements, please contact us at the email address listed in the “Contact Us” section.

INTERNATIONAL SUPPLEMENTS

Argentina

Australia

Belgium

Brazil

Canada

China

Czech Republic

Denmark

Finland

France

Germany

Hungary

Ireland

Italy

Mexico

Netherlands

Poland

Portugal

Russia

Singapore

South Africa

Spain

Sweden

Switzerland

United Kingdom

ARGENTINA

If you provide personal data as part of a recruitment process in Argentina, the following additional information applies.

The local regulator is the Public Information Access Agency (A.A.I.P.)

The local Data Controllers are the entities listed below and their affiliates:Address:MTV Networks Argentina S.R.L.Matheu 1558, Buenos Aires, C1249AAH, ArgentinaTelevisión Federal S.A.Prilidiano Pueyrredón 2989 Piso 2, Martinez, Buenos Aires, B1640ILA, Argentina

In addition:

In accordance with Act No. 25,326 (Personal Data law) and Act No. 20,744 (Labor Contract law) we can transfer your personal data without your consent in these specified cases:

• When the transfer is foreseen or authorized by law.
• When the transfer is necessary for the prevention or medical diagnosis, the provision of health care, medical treatment, or the management of health services.
• When the transfer is necessary or legally required for a reason of public interest.
• When the transfer is necessary for the exercise or defense of a right in a legal process.

AUSTRALIA

If you provide personal data as part of a recruitment process in Australia or if your personal data is collected by any of the local Data Controllers listed below, the following additional information applies.

The local regulator is the Office of the Australian Information Commissioner (OAIC).

The local Data Controllers are the entities listed below and their affiliates:Address:CBS International Television Australia Pty Limited1-31 Saunders Street, Pyrmont, New South Wales 2009, AustraliaNetwork Ten Pty Ltd.Nickelodeon Australia Management Pty Ltd.1 Saunders St, Pyrmont, New South Wales 2009, AustraliaParamount Home Entertainment (Australasia) Pty LimitedLevel 1, 65 Pirrama Road, Pyrmont, New South Wales 2009, AustraliaParamount Pictures Australia Pty.Simon & Schuster (Australia) Pty LimitedSuite 2 14-16 Suakin Street, Pymble, New South Wales 02073 AustraliaVIMN Australia Pty Ltd1 Saunders St, Pyrmont, New South Wales 2009, Australia

Workplace surveillance

• Surveillance devices will not be used in the following locations in changing rooms, toilet facilities, shower, or other bathing facilities
• Where camera surveillance takes place, the camera will be clearly visible in the place where surveillance is taking place and signs notifying people of the surveillance will be clearly visible at the entrance to the workplace;

• Where computer surveillance takes place, it will be carried out in accordance with local laws and Paramount policy;
• Where tracking surveillance is used in relation to a vehicle (or other thing), there will be a notice visible on the vehicle (or other thing) indicating that it is the subject of tracking;
• Covert surveillance in the workplace will not occur unless authorized by a Magistrate (i.e. for determining whether a worker is engaged in an unlawful activity in the workplace).

Special personal data

Not all of the grounds for processing special personal data described in the section of this Notice entitled “PROCESSING SPECIAL PERSONAL DATA” apply to your special personal data. As such, we will only process your special personal data as permitted by law, for example where we have received your consent to do so or the collection is required by law.

Complaints

If we receive a complaint from you in relation to our processing of your data, we will investigate the complaint and determine whether a breach of this Notice or the Privacy Act has occurred and what action, if any, to take. Paramount will take any privacy complaint seriously and will aim to resolve any such complaint in a timely and efficient manner, and our target response time is one month unless your query is complex. Paramount expects our procedures will deal fairly and promptly with your complaint. However, if you remain dissatisfied, you can also make a formal complaint with the OAIC:

Office of the Australian Information Commissioner (OAIC)

1300 363 992

Director of Compliance

Office of the Australian

Information Commissioner

GPO Box 5218

Sydney NSW 2001

www.oaic.gov.au

Complaints to the OAIC must be made in writing.

BELGIUM

If you provide personal data as part of a recruitment process in Belgium, the following additional information applies.

The local regulator is the Data Protection Authority (in Dutch: ‘Gegevensbeschermingsautoriteit’ / in French: ‘l'Autorité de protection des données’).

The local Data Controller is the entity listed below and its affiliates:Address:VIMN Belgium BvbAHavenlaan 86C bus 204, 1000 Brussels

In addition:

• If we would like to process (reproduce/disclose) your picture, we will ask for your active and explicit consent (by means of a paper consent form or by ticking a box electronically). This does not apply to pictures you have voluntarily provided (such as in your CV, or via chat or video conferencing tools) or if we have another legal basis to process it (e.g. pictures on access badges, the relevant legal basis for which is our legitimate interest in ensuring the security of our premises).
• If we would like to carry out reference checks with third parties, we will ask for your explicit consent and keep you informed when we request information from external organizations and persons.
• Monitoring of diversity and equal opportunities: as there is currently no exception for Belgian companies from the prohibition on processing special personal data as part of a diversity policy, we will not process any special personal data for this purpose unless otherwise permitted under applicable law or will do so on an anonymous basis only.
• When we use CCTV, we will observe the provisions of national collective bargaining agreement no. 68.

BRAZIL

If you provide personal data as part of a recruitment process in Brazil, the following additional information applies.

The local regulator is the National Data Protection Authority (in Portuguese: Autoridade Nacional de Proteção de Dados – ANPD), as created by the Law No. 13,709/2018 (LGPD).

The local Data Controllers are the entities listed below and their affiliates:Address:Paramount Pictures Brasil Distribuidora de Filmes LtdaAv. Rio Branco 311, 11th Floor, Centro, Rio de Janeiro, 20046 900Porta dos Fundos Produtora e Distribuidora Audiovisual S.A.Rua Assunção, No. 49, Botafogo, Rio de Janeiro, CEP22251-030Viacom Networks Brasil Programacao Televisiva E Publicidade Ltda.Rua Dr. Renato Paes de Barros, 1017, sala 132, Itaim Bibi, Sao Paulo, CEP 04530-001

In addition:

• We may process special personal data if the processing is necessary for the purpose of preventing fraud and ensuring the safety of the data subject with respect to registering for and authenticating access to our electronic systems.

• Any kind of background checks will be carried out only if strictly necessary in connection with the duties assigned.

• Brazilian data protection legislation does not include any specific provisions on processing personal data for equality and diversity purposes. Therefore, we do not process special personal data for these purposes without your consent.

 

CANADA

If you provide personal data as part of a recruitment process in Canada, the following additional information applies.

The statutory regulator in British Columbia is the Information and Privacy Commissioner.

The local Data Controllers are the entities listed below and their affiliates:Address:CBS Broadcast International of Canada Limited2 Bloor Street West, Ste. 2601, Toronto, Ontario, M4W 3E2CBS Canada Holdings Co.Suite 300, 166 King Street East, Toronto, Ontario, M5A 1J3MTV Networks Canada, ULC26 Duncan Street, Suite 400, Toronto, Ontario, M5V2B9Paramount Pictures Entertainment Canada ULC26 Duncan Street, Suite 400, Toronto, Ontario, M5V 2B9

In addition:

If you send us a request (to the email address provided in this Notice) to access or correct your personal data, we will contact you within 30 days (although it may take us longer to fully respond to your request).

CHINA

If you provide personal data as part of a recruitment process in the People’s Republic of China, the following additional information applies.

The local regulators are the Cyberspace Administration of China (CAC), Industry and Information Technology Department Bureau and Public Security Bureau.

The local Data Controllers are the entities listed below and their affiliates:Address:Beijing Yalian Online Network Technology Co. Ltd.Shang 8 Advertising Center E-101 A, 3A Xiadian, Chaoyang District, BeijingParamount Movie and TV Program Planning (Beijing) Co., Ltd.02,03,05,06,07 within 401 located at No. 77 Jianguo Road, Chaoyang District, BeijingViacom Asia (Beijing) Advertising and Media Co. Ltd.Shang 8 Advertising Center E-101 A, 3A Xiadian, Chaoyang District, Beijing

In addition:

• We do not process personal data without your consent. The purpose of the collection of personal data, the scope of the information collected, and the individuals or entities with which the data will be shared and accessed are generally listed in the above Notice. If we collect personal data from a third party, we will do so with your consent.
• As noted above, we may require you to provide emergency contact information and information of your next of kin, and you are responsible for getting necessary consent from these individuals whose personal data is provided to us and agree that, when disclosing the personal data of these individuals, you will be acting on their behalf.

CZECH REPUBLIC

If you provide personal data as part of a recruitment process in the Czech Republic, the following additional information applies.

The local regulator is Úřad pro ochranu osobních údajů.

The local Data Controller is the entity listed below and its affiliates:Address:Paramount Networks International Czech s.r.o.Perlová 371/5, Prague 1, Prague, 110 00

In addition:

The following examples of the personal data that we process and our grounds for processing them differ from those provided in the Notice above:

• Before you begin your employment, we only process personal data relevant to the application process, i.e. personal data relating to qualifications, work experience, skills, and knowledge.
• The Czech data protection legislation does not allow for the processing of special personal data for equality and diversity purposes.
• Generally, we will not process any information on:

(a) pregnancy;

(b) family and property situation;

(c) sexual orientation;

(d) national/ethnic origin;

(e) trade union organization membership;

(f) membership of political parties or movements;

(g) religion or confession; or

(h) criminal records.

However, with the exception of (c), (d), (e), (f) and (g), we may process the above in rare cases where there is an objective reason for doing so relating to your role (for example if you are pregnant in relation to your parental leave or if you are responsible for large amounts of money, information about your criminal record may be requested). We may also process such personal data in cases where we are legally required to do so.

DENMARK

If you provide personal data as part of a recruitment process in Denmark, the following additional information applies.

The local regulator is the Datatilsynet (the Danish Data Protection Agency).

https://www.datatilsynet.dk/forside/

The local Data Controllers is the entity listed below and its affiliates:Address:VIMN Nordic AB, filial af VIMN Nordic ABFlæsketorvet 26-28, 1, DK-1711 København V

In addition:

• If we would like to process (reproduce/disclose) your picture for marketing or customer/client relations purposes, we will ask for your consent. This does not apply to pictures you have voluntarily provided (such as in your CV, chat, or video conferring tools) or if we have another legal basis to process it.
• Danish legislation does not include any specific provisions allowing the processing of personal data for equality and diversity purposes. Therefore, we do not process special personal data for these purposes except for age, gender, and disability, in which case we will ask for your consent, or we will do so on an anonymous basis only.

FINLAND

If you provide personal data as part of a recruitment process in Finland, the following additional information applies.

The local regulator is Tietosuojavaltuutettu (the Data Protection Ombudsman) (http://tietosuoja.fi/en/index.html)

The local Data Controller is the entity listed below and its affiliates:Address:VIMN Nordic AB, filial i FinlandMannerheiminaukio 1, 00100, Helsinki, Uusimaa

In addition:

• We only process personal data that is directly necessary for your employment relationship.
• We primarily collect personal data directly from you. If we collect personal data from elsewhere, we will do so only with your consent. In any event, we will notify you of the collection of your personal data from such external sources prior to making any decisions based on that information.
• CCTV surveillance will be used only where the legal requirements for its use are fulfilled, including, but not limited to, any prior cooperative and consultative procedures. The personal data collected will be used only for the purposes for which the CCTV was originally implemented.

FRANCE

If you provide personal data as part of a recruitment process in France, the following additional information applies.

The local regulator is the Commission Nationale de l’Informatique et des Libertés (CNIL).

The Data Controllers are the entities listed below and their affiliates:Address:Game One SAS 345922 rue Jacques Dulud, 92521 Neuilly Sur SeineMTV Networks SARL 3454Paramount Pictures France SARL20-24, rue Jacques Ibert 92300 Levallois-PerretWorldwide Enterprises (France) SARL13, rue du 4 Septembre, 75002 Paris

In addition:

• The French data protection legislation does not include any specific provisions on processing personal data for equality and diversity purposes. Therefore, we do not process special personal data for these purposes without your consent or will do so on an anonymous basis only.
• Under French data protection legislation, you have the right to give instructions on what happens with your personal data after your death.

GERMANY

If you provide personal data as part of a recruitment process in Germany, the following additional information applies.

The local regulator is:

Baden-WuerttembergDer Landesbeauftragte für den Datenschutz in Baden-Württemberghttps://www.baden-wuerttemberg.datenschutz.deBavariaBayerisches Landesamt für Datenschutzaufsichthttps://www.datenschutz-bayern.deBerlinBerliner Beauftragter für Datenschutz und Informationsfreiheithttps://www.datenschutz-berlin.deBrandenburgDie Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsichthttp://www.lda.brandenburg.deBremenDie Landesbeauftragte für Datenschutz und Informationsfreiheithttps://www.datenschutz.bremen.deHamburgDer Hamburgische Beauftragte für Datenschutz und Informationsfreiheithttp://www.datenschutz-hamburg.deHessenDer Hessische Datenschutzbeauftragtehttp://www.datenschutz.hessen.deNiedersachsenDie Landesbeauftragte für den Datenschutz Niedersachsenhttps://www.lfd.niedersachsen.deMecklenburg-VorpommernDer Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommernhttps://www.datenschutz-mv.deNordrhein-WestfalenLandesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalenhttps://www.ldi.nrw.deRheinland-PfalzDer Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalzhttps://www.datenschutz.rlp.deSaarlandLandesbeauftragte für Datenschutz und Informationsfreiheithttp://www.datenschutz.saarland.deSaxonyDer Sächsische Datenschutzbeauftragtehttps://www.saechsdsb.deSaxony-AnhaltLandesbeauftragter für den Datenschutz Sachsen-Anhalthttp://www.datenschutz.sachsen-anhalt.deSchleswig-HolsteinUnabhängiges Landeszentrum für Datenschutz Schleswig-Holsteinhttps://www.datenschutzzentrum.deThüringenThüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheithttp://www.tlfdi.deThe local Data Controllers are the entities listed below and their affiliates:Address:CBS International GmbHMunchen Geschaftsanschritt, Prinzregentenstrabe 72, 81675 MunichParamount Pictures Germany GmbHBetastrasse 10c, D-85774, UnterföhringPluto TV Europe GmbhBoxhagener Strasse 80, 10245, BerlinVIMN Germany GmbH

In addition:

In Germany, personal data will be processed where necessary under Section 26 of the Federal Data Protection Act ("Bundesdatenschutzgesetz") and on the following legal bases:

• For employment-related purposes where necessary for hiring decisions or to exercise or satisfy rights and obligations laid down by law or by collective agreements or other agreements between us and the staff council.
• To detect crimes only if there is a documented reason to believe you have committed a crime while employed, and where the processing of such personal data is necessary to investigate the crime and is not outweighed by your legitimate interest in us not processing the personal data (and in particular where the type and extent of the data processing are not disproportionate to the reason).
• If your personal data is processed on the basis of consent, we shall take into account whether you are able to freely give it. This may include where there is an economic advantage for you, or where we are pursuing the same interests. Consent will normally be requested in written or electronic form unless a different form is appropriate because of special circumstances. Where we rely on consent, we ensure you are fully informed and you will have the right to withdraw consent.
• Special personal data:

   

  • If it is necessary to exercise rights or comply with legal obligations derived from labor law, social security and social protection law, and there is no reason to believe that the you have an overriding legitimate interest in us not processing the personal data. Where we process such personal data based on your consent, we will request the consent specifically. We may also process special personal data on the basis of collective agreements.
  • The German data protection legislation does not include any specific provisions on processing personal data for equality and diversity purposes. Therefore, we do not process special personal data for these purposes without your consent or will do so on an anonymous basis only.

HUNGARY

If you provide personal data as part of a recruitment process in Hungary, the following additional information applies.

The local regulator is the National Data Protection and Freedom of Information Authority (http://www.naih.hu/).

The local Data Controller is the entity listed below and its affiliates:Address:Viacom International Hungary Kft.Bocskai road 134-146, Dorottya udvar 1113 Budapest

In addition:

The following examples of the data that we process and grounds for processing differ than as provided in this Notice:

• Hungarian data protection legislation does not include any specific provisions on processing personal data for equality and diversity purposes. Therefore, we do not process special personal data for these purposes without your consent or will do so on an anonymous basis only.
• Data regarding disability may be processed based on Act CXCI of 2011 to determine the percentage of disabled employees, calculate the amount of the rehabilitation contribution payable by Paramount, and to determine if Paramount is entitled to further allowances.

IRELAND

If you provide personal data as part of a recruitment process in Ireland, the following additional information applies.

The local regulator is the Data Protection Commission (www.dataprotection.ie).

The local Data Controller is the entity listed below and its affiliates:Address:Paramount Pictures Services UK2^nd Floor Morrison Chambers, 32 Nassau Street, Dublin

In addition:

• Irish data protection legislation does not include any specific provisions on processing personal data for equality and diversity purposes. Therefore, we do not process special personal data for these purposes without your consent or will do so on an anonymous basis only
• Generally, we do not carry out criminal record checks in Ireland unless this is particularly necessary given your role – e.g. you are going to be working with children or vulnerable adults. We may also require you to complete a self-declaration questionnaire where relevant to a particular role.
• Generally, we do not carry out credit background checks in Ireland, but we may carry out judgment and bankruptcy searches against current or prospective employees where necessary and proportionate, as such databases are accessible by the general public.

ITALY

If you provide personal data as part of a recruitment process in Italy, the following additional information applies.

The local regulator is Autorità Garante della Privacy.

The local Data Controllers are the entities listed below and their affiliates:Address:CBS International Television Italia S.r.l.Via Vittorio Veneto N.54/B c/o Spaces Veneto - centre n. 5076Paramount Home Entertainment (Italy) S.r.l.Via Matteo Bandello N.5, 20123, MilanViacom International Media Networks Italia SRLCorso Europa N.5, 20122, Milan

In addition:

Italian data protection legislation does not include any specific provisions on processing personal data for equality and diversity purposes. Therefore, we will generally only process personal data, including special personal data, for these purposes where we have a legal obligation – e.g. in relation to gender and disability reporting – we have your consent; or we do so on an anonymous basis.

 

MEXICO

If you provide personal data as part of a recruitment process in Mexico, the following additional information applies.

The statutory regulator is the National Institute for Transparency, Access to Information and Personal Data Protection (‘INAI’)

The local Data Controllers are the entities listed below and their affiliates:Address:MTV Networks de Mexico, S. de R.L. de C.V.Paseo de los Tamarindos No. 400A, Seccion Poniente, Piso 29, Colonia Bosques de las Lomas, Mexico, D.F., 05120Paramount Pictures Mexico S. de R.L. de C.V.Av. Paseo de las palmas No. 425, piso 9, Torre Optima 3, Col. Lomas de Chapultepec, Mexico, D.F., 11000

In addition:

In terms of the Federal Law on the Protection of Personal Data in the Possession of Private Parties and its Regulations, note that in the event we refuse to respond to a request regarding your personal data rights, or in the case that you disagree with our response, you may file before the National Institute of Transparency, Access to Information and Personal Data Protection the corresponding Application for the Protection of Rights within the deadlines and terms established by chapter VII and other related chapters, as well as the ones relevant from the Regulations to the Law.

NETHERLANDS

If you provide personal data as part of a recruitment process in the Netherlands, the following additional information applies.

The local regulator is Autoriteit Persoonsgegevens. Mailbox 93374, 2509 AJ THE HAGUE. Phone: (+31) – (9)70 88 85 00.

The local Data Controllers are the entities listed below and their affiliates:Address:CBS International (Netherlands) B.V.Gerrit van der Veenstraat 11, 1077 DM, AmsterdamParamount International (Netherlands) B.V.Atlas Arena, Asia Building, 2nd Floor, Hoogoorddreef 5 1101 BA, AmsterdamVIMN Netherlands B.V.NDSM-plein 6, 1033 WB, Amsterdam

In addition:

• Data regarding nationality, race and ethnic origin may be processed for diversity monitoring / equal opportunities purposes where necessary in order to reduce factual disadvantages related to race or ethnic background. However, we will stop such processing if you ask us to.

• Data regarding disability may be processed for diversity monitoring / equal opportunities purposes in order to meet our legal obligations.
• With regard to other special personal data categories, we will not process this personal data for the purposes of diversity monitoring / equal opportunities purposes or will do so on an anonymous basis only.

POLAND

If you provide personal data as part of a recruitment process in Poland, the following additional information applies.

The local regulator is the Prezes Urzędu Ochrony Danych Osobowych (The President of the Personal Data Protection Office), Stawki 2, 00-193 Warsaw, Poland.

The local Data Controllers are the entities listed below and their affiliates:Address:VIMN Poland Sp. z o.o.ul. Mokotowska 19, 00-560 WarsawParamount Poland sp. z. o.o.

In addition:

• If hired, your personal data will be processed and kept for the period of performance of your employment contract, and after the expiration of the contract for the period necessary for us to perform our legal obligations deriving from legally binding provisions. If your personal data is only useful for a short period (for example a record of a holiday request), we will delete it when it is no longer useful (during your employment), in accordance with our retention policies.
• The following provisions of local law determine the retention periods for your personal data:

   

  • regarding employee documentation (dokumentacja osobowa i płacowa) – Polish Labor Code (Kodeks pracy) and the relevant regulations pertaining to employee documentation issued under the Labour Code; and
  • regarding the personal data processed by means of the CCTV – Polish Labor Code.
• Polish data protection legislation does not include any specific provisions on processing personal data for equality and diversity purposes. Therefore, we do not process special personal data for these purposes without your consent or will do so on an anonymous basis only.

PORTUGAL

If you provide personal data as part of a recruitment process in Portugal, the following additional information applies.

The local regulator is Comissão Nacional de Protecção de Dados (CNPD).

The local Data Controller is the entity listed below and its affiliates:Address:MTV Networks Unipessoal LdaAvenida da Liberdade, 245, 4.ºA, 1250-143, Lisbon

In addition:

• We will not collect or process any CCTV images in the interior of spaces reserved to employees, such as dining areas, locker rooms, etc. In any case and when admissible, video surveillance with sound recording will normally only occur upon prior authorization from the local regulator.
• Any personal data recorded by remote surveillance will generally only be used in the context of criminal proceedings. In that situation, such personal data may also be used to establish disciplinary responsibility.
• We do not process special personal data for equality and diversity purposes without your consent or will do so on an anonymous basis only.
• Background checks will be carried out only if strictly necessary in connection with the duties assigned and to the extent that this would be allowed under the applicable law.

RUSSIA

If you provide personal data as part of a recruitment process in Russia, the following additional information applies.

The local regulator is the Russian Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor).

The local Data Controllers are the entities listed below and their affiliates:Address:OOO MTV Networks Entertainment VostokVarshavskoe shosse 9, Building 1B, 117105, MoscowOOO MTV Networks Music VostokOOO MTV Networks Nick VostokOOO MTV Networks VostokOOO VIMN Holdings VostokOOO VIMN Media Vostok

Legal grounds for processing personal data

In most scenarios described in the “FURTHER INFORMATION ON THE PERSONAL DATA WE PROCESS AND OUR PURPOSES” section of this Notice we will request your explicit consent to the processing of your personal data for the respective purposes. Moreover, where we are required to do so by Russian law, we will request your consent. Grounds for the data processing described in said section of this Notice apply together with your consent and will further apply in case you revoke your consent.

Further information on the data we process and our purposes

Subject to certain statutory exceptions, we will not process personal data relating to your criminal convictions. In general, we will process your special personal data and biometric data only to an extent we need to do so as per Russian law and subject to your consent.

Who gets to see your data?

We will keep records of the third parties who may access your personal data or otherwise may be involved in its processing. If you want to learn more about such third parties, please contact us at EmployeePrivacy@viacomcbs.com.

Retaining your personal data

As per Russian tax, accounting, and archive laws we are required to retain certain documents containing your personal data. For example, we may need to retain your personnel files and employment contracts for up to 50 years. We put in place all appropriate safeguards to ensure that such documents are retained in a secure manner and destroyed upon expiration of the prescribed statutory terms.

International transfers

Although we may transfer your personal data outside Russia, we will in any case make sure that we comply with applicable local requirements on the initial processing of your personal data in Russia (e.g. data localization requirements).

How we process your personal data

In most cases, we process your personal data with the use of automated means, however in some cases we also need to do so without such means (manually).

We may process your personal data by way of any operations to the extent required to fulfil the processing purposes declared. In particular, such operations may include collection, recording, systematization, accumulation, storage, specification (update, modification), retrieval, use, transfer (provision, access, dissemination), depersonalization, blockage, deletion, or destruction of personal data.

SINGAPORE

If you provide personal data as part of a recruitment process in Singapore, the following additional information applies.

The local regulator is the Personal Data Protection Commission (“the PDPC”).

The local Data Controllers are the entities listed below and their affiliates:Address:MTV Asia151 Lorong Chuan #03-08 New Tech Park (Lobby H) Singapore 556741Nickelodeon Asia Holdings Pte Ltd

The Personal Data Protection Act 2012 establishes a general data protection law in Singapore which governs the collection, use and disclosure of individuals’ personal data by organizations. “Organizations” include any company formed or recognized in Singapore or having an office or a place of business in Singapore.

SOUTH AFRICA

If you provide personal data as part of a recruitment process in South Africa, the following additional information applies.

The local regulator is the Information Regulator.

The local Data Controllers are the entities listed below and their affiliates:Address:CBS News Inc.

18 Bompas Road, Dunkeld West,

Johannesburg 2196

Viacom International Media Networks Africa (Pty) Ltd2 Bruton Road, Bryanston, Sandton, Johannesburg, 2191

Your rights under the laws of South Africa

If you are a resident of South Africa, you have certain additional rights under South African law:

• The right to be notified that your personal data is being collected;
• The right to be notified that your personal data has been accessed or acquired by an unauthorized person;
• The right not to have your personal data processed for purposes of direct marketing by means of unsolicited electronic communications;
• The right not to be subject to a decision based solely on the automated processing of your personal data intended to provide a profile of you;
• The right to submit a complaint to the Information Regulator regarding the alleged interference with the protection of your personal data; and
• The right to institute civil proceedings regarding the alleged interference with the protection of your personal data.

In addition:

When processing personal data and special personal data for diversity and inclusion purposes, we will typically rely on the legal obligations imposed on us under the Employment Equity Act 55 of 1998 in respect of employment equity planning. Where, however, certain personal data is not legally required (for example sexual orientation or LGBTQ status), this personal data will be processed on the basis of specific and explicit consent.

SPAIN

If you provide personal data as part of a recruitment process in Spain, the following additional information applies.

The local regulator is the Spanish Data Protection Authority (www.aepd.es).

The local Data Controllers are the entities listed below and their affiliates:Address:Paramount Spain S.L.U.Albacete 3, 1a Planta, 28027, MadridViacom International Media Networks España, S.L.

Paseo de Recoletos 33, 1a Planta, 28004

Madrid

In addition:

We will generally not process health data and will only receive limited information – i.e. whether an employee is fit for the job from a health perspective. Notwithstanding this, as stated in the Notice, personal data may be collected as necessary to maintain the safety and health of employees in relation to COVID 19 or other pandemics, in accordance with the Return to Workplace Privacy Notice, which may apply to you in the event you enter our worksites.

SWEDEN

If you provide personal data as part of a recruitment process in Sweden, the following additional information applies.

The local regulator is Integritetsskyddsmyndigheten.

The local Data Controllers are the entities listed below and their affiliates:AddressParamount Sweden ABLumaparksvagen 7, 12031, StockholmVIMN Nordic ABKungsbro Strand 31, 112 26, Stockholm

In addition:

We will not process special personal data for diversity and equal opportunities purposes or will do so on an anonymous basis only.

SWITZERLAND

If you provide personal data as part of a recruitment process in Switzerland, the following additional information applies.

The local regulator is the Federal Data Protection and Information Commissioner.

The local Data Controller is the entity listed below and its affiliates:AddressCBS Interactive GmbHBruder-Klausen-Weg 3, 6072 Sachsein

In addition:

• When collecting special personal data, criminal data, or personality profiles, we will inform you in advance of the data collection purpose and of any data recipient and will ask you for your consent.
• We will only gather references from former employers with your prior consent.

UNITED KINGDOM

If you provide personal data as part of a recruitment process in the United Kingdom, the following additional information applies.

The local regulator is the Information Commissioner’s Office (ICO).

The local Data Controllers are the entities listed below and their affiliates:Address:Channel 5 Broadcasting Limited17-29 Hawley Crescent, London, NW1 8TTCBS Broadcast Services LimitedCannon Place, 78 Cannon Street, London EC4N 6AFCBS Interactive LimitedThe Warehouse, The Bower 207-211 Old Street, London EC1V 9NRCBS News UK branch (a division of CBS Broadcasting Inc.)Broadcast Centre Europe, First Floor, Building 10, Chiswick Park, 556 Chiswick High Road, London W4 5XSLast FM LimitedThe Warehouse, The Bower 207-211 Old Street, London EC1V 9NRNickelodeon U.K. Limited17-29 Hawley Crescent, London, NW1 8TTParamount Pictures International LimitedBuilding 5 566 Chiswick High Road, W4 5YFParamount Pictures UKSimon & Schuster (UK) LimitedCannon Place, 78 Cannon Street, London EC4N 6AFThe Paramount UK Partner17-29 Hawley Crescent, London, NW1 8TTViacom Camden Lock LimitedViacom Global LimitedViacom International Media Networks U.K. LimitedVIMN CP Services (UK) Limited

In addition:

When processing special personal data for diversity and inclusion purposes we will typically rely on Schedule 1(8) Data Protection Act 2018 as the legal basis for processing, rather than consent. However, in practice this sort of processing would normally still be voluntary.

This Notice, along with other related Paramount policies and/or protocols, shall form Paramount's policy for processing special personal data as required by the UK Data Protection Act 2018 (Schedule 1 Part IV).

1. For the purposes of this Notice, “Paramount”, “we”, “us” and “our” refer to (i) Paramount Inc., (ii) for U.S. based employees, the Paramount subsidiary that employs you or to which you provide services, and/or, (iii) for employees based outside the U.S., the local Data Controller(s) set out in the International Supplements, and other group companies with whom the data is shared (as outlined in this Notice).↩︎