Legal and Compliance

TWG operates with a compliance-first mindset across every market and engagement. Our compliance program is developed and maintained in partnership with Deloitte, ensuring that our governance, audit readiness and data protection standards align with leading international frameworks.

This Policy describes how TWG collects, uses, processes, stores and protects personal data when you access or use our Platform and Services. By using the Platform, you acknowledge that certain data is required for the proper functioning, delivery and improvement of the Services in accordance with this Policy and our Terms and Conditions.

Depending on the nature of the Services, TWG may act as a data processor on behalf of clients, partners or other organizations, or as an independent data controller. In certain cases, third parties using TWG Services may themselves act as independent data controllers, with TWG processing data solely on their behalf. These roles are defined by the context of the processing and are further detailed in our Data Processing Addendum.

Overview of This Policy

This Policy provides transparency regarding:

• What information we collect
• How and why we process it
• How we protect and safeguard it
• How we share it when required by law or instruction
• What rights you have regarding your personal data

Users in specific jurisdictions may have additional rights, including:

• GDPR rights for residents of the European Economic Area (EEA)
• Rights under local privacy laws in other applicable regions

By using our Platform, creating an account or submitting information, you consent to the

collection and processing of your data as described in this Policy.

Processing of Data

Depending on the context of the Services, users may act as data controllers or data

processors, and TWG may act as a data processor or an independent data controller

accordingly.

User Responsibilities

Users are solely responsible for:

• The accuracy, quality and legality of the personal data they provide
• Ensuring a lawful basis exists for collecting and submitting such data
• Providing TWG with clear, lawful and documented processing instructions

Users must not submit personal data that is unlawful, irrelevant or inappropriate for the

Services. TWG is not liable for claims arising from unlawful or unauthorized data provided

by users.

TWG Responsibilities

TWG processes personal data:

• Only for the purposes required to deliver the Services
• In accordance with documented user instructions where applicable
• In compliance with all relevant data protection laws and regulations

TWG does not process personal data for independent purposes unless required by

applicable law or a competent regulatory authority.

Data Processing Activities

TWG engages in various processing activities depending on the nature of the Services and

the applicable role.

When TWG Acts as a Data Processor

We:

• Store, host and manage personal data submitted by users through the Platform
• Process data strictly according to documented user instructions
• Provide technical support and assistance related to data processing
• Assist users in responding to data subject requests where applicable

When TWG Acts as a Data Controller

We:

• Collect and manage user account and registration data
• Handle communication, support and operational interactions
• Analyze usage data to improve Platform performance and user experience
• Ensure compliance with legal and regulatory obligations

Types of Personal Data

• Identification data: name, surname, date of birth
• Contact information: email address, phone number
• Professional and profile data: skills, experience, certifications, preferences
• Technical and device data: IP address, browser type, device identifiers
• Usage data: interaction with Platform features and Services
• Communication and support data: messages, support requests, feedback

Purposes of Processing

We process personal data to:

• Operate and maintain the Platform and deliver the Services
• Manage user accounts and onboarding processes
• Facilitate communication between users and TWG
• Improve performance, usability and user experience
• Ensure security, prevent fraud and detect misuse
• Comply with legal, regulatory and contractual requirements

Where TWG acts as a data controller, processing is based on a valid legal basis such as contractual necessity, legal obligation, consent or legitimate interest, provided that such interests are not overridden by the rights and freedoms of the data subject.

Data Governance and Processing Principles

TWG applies strict governance standards to ensure lawful, secure and transparent processing across all operations.

Lawful and Transparent Processing

• All processing activities have a clearly defined and documented purpose
• Users are informed about how and why their personal data is processed
• Privacy notices are accessible and written in clear, structured language
• Significant changes to processing activities are communicated in advance

Legal Basis for Processing

Processing may rely on one or more of the following legal bases:

• Consent provided by the data subject
• Necessity for the performance of a contract
• Compliance with a legal obligation
• Legitimate interests pursued by TWG, where not overridden by data subject rights

Users are informed of the applicable legal basis at or before the point of data collection.

Purpose limitation & data minimization

TWG collects and processes only what is necessary for specific, legitimate purposes. Personal data is not retained or reused beyond what is required, and excessive or unrelated data is neither requested nor stored within our systems.

Security and Confidentiality

TWG applies strict technical and organizational safeguards to protect personal data against unauthorized access, disclosure, alteration or destruction. Our security infrastructure includes:

• Zero-Trust Architecture and Identity Access Management
• Enterprise-grade encryption across all communication channels
• Role-based access restricted to authorized personnel only
• TIER III/IV and Private Cloud Data Center environments with redundant systems
• Secure, audited and fully compliant home-based workstation environments
• Continuous monitoring, audit readiness and DPO-led governance
• Data residency and sovereignty options where required

TWG maintains full accountability for all data processing activities, including those performed by third-party service providers. All partners and vendors operate under binding data processing agreements aligned with our protection standards and applicable regulations.

Cookies and Tracking

TWG uses cookies and similar tracking technologies to operate and improve the Platform. These may include essential cookies required for the functioning of the Services, as well as analytics cookies used to understand usage patterns and improve performance.

Where applicable, you will be presented with a cookie consent notice allowing you to manage your preferences. You may withdraw consent or adjust your cookie settings at any time through your browser or account preferences. Note that disabling certain cookies may affect the availability or functionality of some Platform features.

Data Retention

TWG retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting or reporting requirements.

Retention periods are determined based on the type of data, the nature of the relationship and applicable legal obligations. When personal data is no longer required, it is securely deleted or anonymized in accordance with our internal data lifecycle policies.

Where TWG acts as a data processor, retention is governed by the documented instructions of the relevant data controller, subject to applicable legal requirements.

Your Rights

Depending on your jurisdiction, you may have the following rights in relation to your personal data:

• Right of access: Right of access
• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate or incomplete data
• Right to erasure: to request deletion of your personal data where no longer necessary
• Right to restriction: to request that we limit processing your data in certain circumstances
• Right to data portability: to receive your data in a structured, commonly used format
• Right to object: to object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting prior processing

To exercise any of these rights, please contact our Data Protection Officer at: dpo@talentworldgroup.com. We will respond to all valid requests within the timeframes required by applicable law (typically 30 days under GDPR).