Applicant Privacy Notice

This Job Applicant Privacy Notice ("Notice") explains FanDuel’s handling of your personal data.

When we say "FanDuel", "we" or "us" in this document, we mean the employer to which you are applying for a job, which is FanDuel Limited (in the UK) or FanDuel Inc. (in the U.S.). As with many other FanDuel policies, this notice does not guarantee that you will be hired and, if you are hired, this document will not be not part of your contract of employment, and we may update it from time to time.

What categories of personal data does FanDuel collect about me and why does FanDuel use it?

FanDuel will collect, process and use the following categories of personal data about you (“Applicant Data”):

• identification data, such as your name, citizenship, photo, applicant ID, passport data, date and place of birth, national identification number, signature, as well as other government-issued identification information;
• contact details, such as your home address, telephone number and email address;
• social media profile information, if you choose to apply online by using your profile;
• information about your job record, education, and additional application-relevant data, such as position, business title, employee type, management level, time type (full or part time and percentage), work location, division, department, position level, manager (name & ID), support roles, start and end date, job history (including position history, title history, effective dates and past pay groups), CV or resume, qualification testing results, education history, skills, certifications, background check results, reason for leaving, and other information from interviews with you, your references or other third parties.

We collect and use this Applicant Data for a variety of reasons linked to your candidacy. To help clarify these we have set out below a list of reasons why we collect and use this data (the "Processing Purposes") along with examples of some of the Applicant Data used for each of the Processing Purposes:

• evaluating and responding to your employment application, including reviewing your education and job history, facilitating interviews, checking references and conducting background checks, and notifying you of relevant additional vacancies with us that may interest you, which involves the processing of identification data, contact details, and information about your job record and, where appropriate and permitted by law, other personal history;
• setting up your employment and compensation, including to secure travel or employment visas, and establish payroll and other compensation and benefits, which involves the processing of identification data, contact details, information about your job record;
• complying with applicable laws and employment-related and pre-employment-related requirements along with the administration of those requirements, such as income tax, social security deductions, and employment and immigration laws, which involves the processing of identification data, contact details, information about your job record;
• monitoring and ensuring compliance with applicable policies and procedures and laws, including conducting internal investigations, which involves the processing of identification data, contact details, information about your job record and potential job;
• communicating with you, FanDuel employees and third parties, which involves the processing of identification data, contact details, information about your job record and potential job; and other data relevant to your application; and

• responding to and complying with requests and legal demands from regulators or other authorities in or outside of your home country, which involves the processing of identification data, contact details, information about your job record, and could include processing of any other categories of Applicant Data depending on the nature of the demand.

Certain types of Applicant Data that FanDuel collects, processes and uses fall into the following special categories of personal data which we describe as "Sensitive Applicant Data":

"Sensitive Applicant Data":

• health and medical data, such as information on disability for purposes of accommodating the work place and compliance with legal obligations;
• criminal records data, in the event you have go through a criminal records background check, where relevant and appropriate to your role;
• trade union membership where required to address labour law; and
• race or ethnicity data such as information contained in your passport or other citizenship and right to work documentation, and information which you have voluntarily provided to FanDuel for the purposes of our equal opportunities and diversity monitoring and initiatives.

Why does FanDuel need to collect, process and use my Applicant Data and Sensitive Applicant Data?

Where applicable, UK law requires FanDuel to explain to you the legal bases for our collecting, processing and use of your Applicant Data and Sensitive Applicant Data:

For Applicant Data, our legal bases under UK law are:

• taking steps at your request prior to entering into a contract of employment or other contract with you;
• compliance with legal obligations, in particular in the area of labour and employment law, social security and social protection law, data protection law, tax law and corporate compliance laws;
• legitimate interest of FanDuel or its affiliates;
• your consent, where that is appropriate and allowed by local data protection law.

For Sensitive Applicant Data, our legal bases under UK law are, where permitted by law:

• explicit consent as allowed by local data protection law;
• to carry out the obligations and to exercise the specific rights of FanDuel or you in the field of employment and social security and social protection law as permitted by local data protection law and/or a qualifying collective agreement;
• to establish, exercise or defend legal claims or whenever courts are acting in their judicial capacity;
• for substantial public interest as permitted by local data protection law; and
• for assessment of your potential working capacity as permitted by local data protection law.

Where we talk about legitimate interests of FanDuel or third parties, this can include:

• sharing information within our corporate family;
• human resources management;
• workplace safety;
• prevention of fraud, misuse of company IT systems, or money laundering;
• physical security, IT and network security;
• addressing certain domestic or foreign legal requirements;
• internal investigations;
• dispute resolution;
• responding to due diligence requests, and
• preparation for and participation in mergers, acquisitions, asset sales or transfers, or other similar transaction.

With whom might FanDuel share my personal data?

FanDuel may transfer personal data for the Processing Purposes to the following:

• Other members of the FanDuel corporate family. FanDuel Limited and FanDuel Inc. process the data for the Processing Purposes and handle it pursuant to this FanDuel Applicant Privacy Notice.
• Service providers. As necessary for the Processing Purposes described above, personal data may be shared with one or more third parties, whether affiliated or unaffiliated, to process personal data under appropriate instructions ("Service Providers"). For example, the Service Providers may carry out instructions related to recruiting administration, IT system support, training, compliance, and other activities relevant to the Processing Purposes, and will be subject to appropriate contractual obligations.
• Regulators, authorities and other third parties. As necessary for the Processing Purposes described above, personal data may be transferred to regulators, courts and other authorities (e.g., tax and law enforcement authorities), independent external advisors (e.g., auditors and legal advisors), directors of FanDuel Limited or FanDuel Inc., insurance carriers, benefits providers, internal compliance and investigation teams (including external advisers appointed to conduct internal investigations).
• Acquiring entities. If a FanDuel entity may be sold or transferred in whole or in part (or such a sale or transfer is being contemplated), your personal data may be transferred to the new employer or potential new employer as part of the transfer itself or as part of an initial review for such transfer (e.g., due diligence), subject to any rights provided by applicable law, including jurisdictions where the new employer or potential new employer are located.

Some of the recipients we may share Applicant Data and Sensitive Applicant Data with may be located in countries outside of Europe. In some cases, this may include countries located outside the European Union and/or European Economic Area ("EEA"), including in jurisdictions that the European Union has not recognized as providing an adequate level of protection. In such cases, we make the transfers in compliance with applicable law, typically in reliance on Standard Contractual Clauses approved by the European Commission for such purposes or in reliance on the recipient’s participation in the EU/Swiss-

U.S. Privacy Shield program. You may request a copy of the Standard Contractual Clauses by contacting us as described below.

How long will FanDuel keep my personal data?

It is our policy not to keep personal data for longer than is necessary for the Processing Purposes.  Where personal data is kept beyond the time that we normally would need to keep it, that period will be determined based on the applicable local law.

What rights do I have in respect of my personal data?

Applicants have a number of rights in relation to their Applicant Data and Sensitive Applicant Data.  These can be subject to important exceptions. For applicants to FanDuel Limited, they can be summarized in broad terms as follows:

1. 1. Right of access

You have the right to confirm with us whether your personal data is processed, and if it is, to request access to that personal data including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients, and other information about the processing. We do have to take into account the interests of others though, so this is not an absolute right, and in some cases permitted by law we may charge a fee.

1. 2. Right to rectification

You have the right to rectify inaccurate or incomplete personal data concerning you.

1. 3. Right to erasure

You have the right to ask us to erase certain personal data concerning you.

1. 4. Right to restriction of processing

In limited circumstances, you may have the right to request that we restrict processing of your personal data.

1. 5. Right to data portability

You may have the right to receive certain personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to have the data transmitted to another entity.

1. 6. Right to object and rights relating to automated decision-making

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, including profiling, by us and we can be required to no longer process your personal data. This may include requesting human intervention in relation to an automated decision so that you can express your view and to contest the decision.

(vi)       Right to withdraw consent

In the very limited cases in which we may process your personal data on the basis of your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.