This Privacy Notice describes how personal data is processed for prospects and/or applicants who apply for employment at any of the affiliates or subsidiaries of GlobalFoundries. GlobalFoundries respects the privacy of individuals and is committed to collect, use and process personal data in a respectful, secure and lawful manner. In the event that anything in this Privacy Notice is inconsistent with any such law, the relevant right and/or protection shall prevail. This means that some of the processing activities described may not be performed in certain countries. Please contact us if you would like further information in this respect. Therefore, before you agree to this Notice and provide your personal data, please read the following statements, including your obligations, carefully: Personal data we collect We process the personal data that you have sent us in connection with your application in order to check your suitability for the advertised position (or other open positions in our companies, if applicable) and to carry out the application procedure. In the context of a possible job interview, information from the interview may be recorded in writing. This will also serve to check your suitability for the position. With your consent, your data may also be processed to inform you about future job opportunities (talent pool). Your profile and application details can be viewed by our recruiters within our global organization (subject to applicable law) and you consent to our processing of your personal data pursuant to this Notice for the purpose of informing you of future opportunities. We kindly ask you not to upload any personal data or file attachments that are not necessary for our selection process or not requested, especially if the data is sensitive (e.g., information about health, religion, or trade union membership). The processing of your data is based on the applicable data protection laws (e.g., Art. 6(1)(b) GDPR, § 26 BDSG) and DPDPA 4 (1) (a) and 7 (a). We process the following categories of data as part of the application process: Contact details (name, address, email, phone number) Application documents (resume, certificates, references) Data from interviews and assessments Qualifications, skills, certificates Notes from interviews Technical usage data (e.g., IP address, cookies, log files) Purposes of processing: Conducting the application process Assessing suitability for the advertised or other positions Contacting you about future job opportunities (talent pool, if you consent) Fulfilling legal obligations IT security and misuse prevention Background checks GlobalFoundries processes only the personal data that applicants voluntarily provide during the recruitment process or as required or permitted by applicable law. We kindly ask you not to upload any personal data or file attachments that are not necessary for our selection process, especially if the data is sensitive (e.g., information about health, religion, or trade union membership). We do not actively collect or review information from external sources such as search engines, social media platforms, or publicly available registers for recruitment purposes. In exceptional cases where processing of publicly accessible data becomes necessary (e.g., to comply with legal obligations), GlobalFoundries will provide applicants with clear and timely notice in accordance with Article 14 of the GDPR or equivalent applicable law. This Notice will include the categories of data collected, the source of the data, and the purpose of processing. The processing of your data is based on the applicable data protection laws (e.g., Art. 6(1)(b) GDPR, § 26 BDSG) and DPDPA Section 4(a). By adhering to these principles, GLOBALFOUNDRIES ensures transparency, fairness, and compliance with applicable data protection laws. Updating of data: It is extremely important that the information in your applicant profile is always accurate, correct and up-to-date. If your profile data is incomplete, incorrect or not up-to-date, please make the necessary changes using the online function of the web tool. If you have any questions, please contact our HR department by e-mail: EU: [email protected]; USA: [email protected]; Singapore: [email protected]; India: [email protected]; China: [email protected]. How long is the data stored? We process your data for the duration of your time as an applicant. Whether your application for the role is successful or not, GlobalFoundries will retain your data afterwards. We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, HR, regulatory, tax, accounting or reporting requirements, or for as long as your declaration of consent (if applicable) allows us to retain it. Data on closed requisitions will not be stored for more than a maximum 6 months for EU applicants, 4 years for US applicants, and 3 years for all other applicants. We may retain your personal data in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. We will destroy your personal data in a way that does not allow us to recover the information and/or take steps to properly anonymize it so that you can no longer be identified from it. If you have been awarded a job during the application process, the data will be transferred from the applicant data system to our personnel information system. Recipient of your personal data Depending on the branch office where your application is processed, your personal data will first be checked by or on behalf of GLOBALFOUNDRIES U.S., Inc., and its subsidiaries. Due to the global nature of our business, subject to applicable law, your personal information may be shared with authorized individuals (e.g., recruiters, human resources managers and executives) within the worldwide GLOBALFOUNDRIES group of companies. These authorized individuals may also be employed by a different GLOBALFOUNDRIES company than the one that advertised the position. GLOBALFOUNDRIES Group companies are committed to providing an appropriate level of data protection and to effectively protecting your information. This is true even if your information is made available to GLOBALFOUNDRIES companies that are not located in the European Economic Area (EEA) and therefore are not subject to the European Data Protection Directive. In addition to authorized GLOBALFOUNDRIES employees, your personal information may be accessed by service providers engaged in delivering technical support or recruitment-related services. Examples include: IT and hosting providers (e.g., Oracle Corporation Singapore Pte. Ltd.) Application management systems including AI processing (e.g., Eightfold AI Inc., Workday) Other technical support partners under strict contractual obligations. GLOBALFOUNDRIES ensures an adequate level of data protection for all transfers, including those outside the EEA, by implementing safeguards such as Standard Contractual Clauses (SCCs), where applicable. Cross border data transfer will also be subject to compliance with all applicable laws. Furthermore, personal data collected when you access our website will only be disclosed to third parties if required by law or court order (e.g., in the context of criminal prosecution) or if necessary to investigate attacks on the underlying infrastructure. We do not sell or share your personal data with third parties for marketing purposes. If you would like to view the list of GLOBALFOUNDRIES partner companies or have further questions about privacy, please reach out to the contact listed for your region below. Technical Details: Use of Eightfold As part of our recruitment process, we use Eightfold, a cloud-based Talent Intelligence Platform, to manage and analyze candidate data. Eightfold supports our recruiters in identifying suitable candidates, managing applications, and improving the efficiency of our hiring process. By submitting your application, you consent to the transfer and processing of your personal data by Eightfold for the purpose mentioned. Key technical details: Data Hosting: Subject to applicable law, candidate data processed in Eightfold may be hosted in data centers located in the United States, Canada, or the European Union, depending on organizational requirements and applicable legal obligations. Access Controls: Access to your data within Eightfold is strictly limited to authorized GLOBALFOUNDRIES personnel and designated service providers who require access for recruitment purposes. All access is governed by strict contractual and technical safeguards. Data Security: Eightfold implements industry-standard security measures, including encryption, access logging, and regular security audits, to protect your personal data from unauthorized access, loss, or misuse. Data Minimization: Only data necessary for the recruitment process is processed in Eightfold. Sensitive data (such as health, religion, or trade union membership) should not be provided unless required by law or explicitly requested. Self-Delete Function: Eightfold provides a self-delete function, allowing you to request the deletion of your candidate profile and associated data at any time, subject to applicable legal retention requirements. No AI Model Training: Your personal data will not be used for training artificial intelligence models within Eightfold unless you have provided explicit consent. Third-Party Processors: Any third-party service providers involved in the operation or support of Eightfold are contractually bound to comply with applicable data protection laws and GLOBALFOUNDRIES’ privacy standards. Data backup and technical information: GLOBALFOUNDRIES uses technical and organizational measures to protect your personal information from accidental or unlawful destruction, alteration or loss, and from unauthorized disclosure or access. All access to this website is logged. The log file registers the Internet Protocol (IP) address of the computer, the selected websites, the browser used, the date and time of access and technical information such as the operating system of the computer in question. This information is collected for reasons of data security, for reporting purposes, and for legitimate and legally permitted purposes (e.g., for evaluations in anonymized form that enable GLOBALFOUNDRIES to determine preferred job offers and visited websites, including the various application options) and retained in accordance with applicable law. This applicant management system uses so-called cookies (“session cookies”, “http cookies”), which are necessary to maintain an Internet session. This prevents a user from having to log in more than once when visiting different sub-pages. It also makes it easier to load profile data and save data during its input and maintenance. When the browser connection is terminated, the session of the respective user is also closed by default. GLOBALFOUNDRIES does not assume any liability or guarantee for the privacy practices or the content of such websites, nor does GLOBALFOUNDRIES make any representations or warranties as to the privacy practices or the content of such websites. What is the legal basis for this? The legal basis for processing your personal data in this application procedure depends on the location of the position for which you are applying, including but not limited to: Germany / European Union: • Art. 6(1)(b) GDPR – for processing necessary to initiate and manage the employment relationship (e.g., reviewing your application, scheduling interviews). • Art. 6(1)(c) GDPR – for compliance with legal obligations (e.g., tax, social security, anti-discrimination laws). • Art. 6(1)(f) GDPR – for legitimate interests (e.g., ensuring IT security, preventing fraud). • § 26 BDSG – for processing data required for employment purposes. • Art. 6(1)(a) GDPR (Consent) – where explicit consent is required (e.g., storing your profile for future job opportunities). India: Digital Personal Data Protection Act, 2023 (DPDPA) and Information Technology Act 2000, and rules thereunder which permits processing where consent has been given. Singapore: Personal Data Protection Act (PDPA), which permits processing where necessary for evaluating your application, managing the recruitment process, and fulfilling legal obligations. United States: Applicable federal and state laws, including the California Consumer Privacy Act (CCPA) where relevant, which permit processing for recruitment, compliance, and employment-related decisions. If your data is required for legal prosecution after the application process has concluded, processing may be carried out on the basis of the above laws, in particular to safeguard legitimate interests such as the assertion or defense of legal claims. Please note that not every application will result in an employment relationship. Your data may be processed solely for the purpose of evaluating your application and managing the recruitment process. Your rights as a “data subject”/ data principal You have the right to be informed about the personal data we process about you. If you request information in a form other than writing, we may require proof of identity to ensure that you are the person you claim to be. You also have the right to correct inaccurate data or delete your personal data, or to restrict its processing, insofar as you are legally entitled to do so. Furthermore, you have the right to object to the processing within the scope of the legal requirements. The same applies to your right to data portability. In addition, you have the right to withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before the withdrawal. In addition, you shall have the right to nominate any other individual in the event of death or incapacity. If you wish to exercise your rights, you can log onto the Eightfold applicant portal and review/delete the information from your Profile Section. If you cannot access the portal, please contact us (see below). The terminology and scope of your rights may vary depending on your country of residence and the applicable data protection law (e.g., “data subject” under GDPR, “data principal” under DPDPA India). If you are a Data Principal located in India, you have certain duties which are as follows: comply with the provisions of all applicable laws for the time being in force while exercising rights under applicable laws and this privacy notice; to ensure not to impersonate another person while providing your personal data for a specified purpose; to ensure not to suppress any material information while providing your personal data; to ensure not to register a false or frivolous grievance or complaint with Us or the Data Protection Board of India; and to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under applicable law. Contact Details of Data Privacy Officers: If you have any questions about the processing of your personal data, you can contact our Data Protection Officers at: EMEA Mandy Liesebach Data Privacy Officer [email protected] [email protected] Singapore / APAC Kit Wan Leong Data Privacy Officer [email protected][email protected] USA Emily Roach Data Privacy Officer [email protected] India/APAC Priyanka Gupta Data Privacy Officer [email protected] Competent Data Protection Authorities by Location Germany (Dresden): Sächsischer Datenschutzbeauftragter, Postfach 11 01 32, 01330 Dresden, Germany United States (Malta, NY): Federal Trade Commission (FTC), 600 Pennsylvania Avenue NW, Washington, DC 20580 Singapore: Personal Data Protection Commission (PDPC), 10 Pasir Panjang Road, #03-01 Mapletree Business City, Singapore 117438 India: Data Protection Board of India, Ministry of Electronics and Information Technology, New Delhi China (Chengdu): Cyberspace Administration of China (CAC), No. 11 Chegongzhuang Avenue, Beijing Bulgaria (Sofia): Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria Automated Decision-Making and Use of AI in Recruitment As part of our recruitment process, we use the Eightfold Matching Model, an AI-based tool that helps us identify suitable candidates for open positions. The model creates an enriched talent profile for each candidate, calibrates job profiles, and analyzes complex relationships between these components to generate a “Match Score.” This score indicates the likelihood that a candidate will perform well in the application process and succeed in the job. The Eightfold Matching Model has been independently audited for bias by BABL AI Inc., in accordance with New York City Local Law No. 144 of 2021. The audit tested for disparate impact based on gender and ethnicity. The results showed no disparate impact, with impact ratios above 0.992 for gender categories and 0.923 for race/ethnicity categories. Eightfold also fulfills additional audit requirements, such as appointing an accountable party for ethics and bias. Please note that the final hiring decision is always made by our recruitment team and relevant managers. Automated tools may be used to assist in screening or ranking applications, but they do not make the final decision. In line with applicable data protection laws, you have the right to: Request human intervention if an automated tool has influenced the evaluation of your application, Express your point of view, Contest any automated assessment that may have impacted your application. If you wish to exercise these rights or have questions about the use of automated tools in our recruitment process, please contact us at EMEA: [email protected] USA: [email protected] APAC: [email protected] CCPA Disclosure If you are a resident of California, for purposes of the California Consumer Privacy Act as amended and supplemented by the California Privacy Rights Act of (CCPA) only, please see below a summary of the categories of personal data collected about you, as applicable and as such categories are stated within the CCPA: Categories of Personal Data Examples Identifiers Name, IP address, unique personal identifiers, social security number, usernames, information collected from cookies or other tracking technologies. Categories of personal data under Cal. Civ. Code 1798.80(e) Name, address, social security number, phone number, employment history, passport number, physical characteristics or description Characteristics of protected classifications under California or federal law Gender, marital status, race, physical disability, medical condition, sex, age Sensitive personal information Social security number, passport number, race, health information, sexual orientation information Internet or other electronic network activity information Interactions with our websites, apps, devices or other digital properties Geolocation data Precise location of a device Professional or employment-related information Resume, CV, aptitude tests, employment history, references Education information Education history, degrees obtained, actual or anticipated graduation dates Information from your device Language settings, browser ID, cookie preferences, time zone, operating system, platform, screen resolution and similar information about your device settings, data collected from cookies or other tracking technologies Right of appeal You have the right to complain about the processing of personal data by us to a data protection supervisory authority. If you have any questions regarding the personal data stored about you, wish to object to a consent granted or wish to have your data corrected or deleted, please contact us in writing at the following address or by email: GLOBALFOUNDRIES Management Services LLC & Co. KG Datenschutzbeauftragter Wilschdorfer Landstraße 101 01109 Dresden For Individuals in India (Data Principals): Under the Digital Personal Data Protection Act, 2023 (DPDPA) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), you have similar rights as described above. To exercise your rights/grievances, please contact us at [email protected]. We shall make our best efforts to resolve your grievance within a period of 90 (ninety) days from the date of its receipt. If we fail to resolve your grievance within the said period, only then you shall have an additional right to file a complaint with the Data Protection Board of India. Declaration of consent With the transmission of your personal data and/or submitting your application you confirm that: (1) you have read, understood and agree to the provisions mentioned here; (2) you will provide your personal data and other information relating to your application completely and truthfully, so your data may be processed in Workday and Eightfold for legitimate hiring purposes including AI processing. (3) GLOBALFOUNDRIES is entitled, in compliance with applicable law, to verify the accuracy of the information and data you provide, or have the information and data verified, and to perform any necessary reference checks; (4) You consent to the collection and processing of your data in this Candidate Management System in accordance with this Policy and to processing in subsequent processes and data systems as necessary to fulfill GLOBALFOUNDRIES’ legitimate purposes. (5) Data may be stored in selected hosting regions (USA, Canada, EU) in compliance with applicable law. (6) Data may be processed to inform you about future job opportunities in GlobalFoundries. By submitting, you declare that you have read, understood, and accepted the terms in this policy*
