Head of Payments

Version 1.0 | August 10, 2026

This Privacy Notice explains how Emerging Travel Group (“ETG”, or “we”) collects, uses, and protects your personal data during the recruitment process. It applies to your application for employment with ETG. Below, we describe what information we gather, why we need it, how we keep it safe, and what rights you have regarding your personal data. All our activities are guided by the national or international data protection legislation that governs your specific relationship with us (“Applicable Law”).

1. Who Is Responsible for Your Data

The processing of your personal data is carried out by Leaside Services Limited, located at Office 21, 17 Georgiou Karaiskaki Str., 3032 Limassol, Republic of Cyprus, acting as the operator of the recruitment platform, together with the specific legal entity within ETG that determines the purposes and means of processing your personal data (“Controller”), as identified for your location in the table below.

Where these entities jointly determine the purposes and means of processing, they act as joint controllers and have entered into an arrangement governing their respective responsibilities for compliance with Applicable Data Protection Law. Under that arrangement, Leaside Services Limited is responsible for the overall technical infrastructure of the recruitment process, and general security measures, whereas the specific ETG entity that will be your employer or contracting party (as identified in your final offer letter or service agreement) serves as your primary point of contact for exercising your privacy rights and handling inquiries regarding your personal data. Other group entities may participate in the processing solely to provide unified management, consolidated internal reporting, and centralised technical support across our global infrastructure, and regardless of this internal allocation, you may exercise your rights in respect of, and against, each of these joint controllers.

The table below sets out the designated ETG member entity that acts alongside Leaside Services Limited:

Country	Company	Business Address
Cyprus	Leaside Services Limited	17 Karaiskaki Street, Office 22, Agaia Triada, Limassol, Cyprus, 3032
USA	Emerging Travel Inc.	1000 N West Street, Suite 1200, Wilmington, DE 19801, USA
UK	EMERGING TRAVEL UK LIMITED	Office 2.05, 256–260 Old Street, Albert House, London, UK
Germany	Emerging Travel Germany ETG GmbH	Friedrichstraße 171, 10117 Berlin, Germany
Kazakhstan	Emerging Travel Kazakhstan LLP	Office SP2-18, 280 Baizakova Street, Bostandykskiy District, 050040, Almaty, Republic of Kazakhstan
UAE	Smart Middle East Travel Agency L.L.C	Office P2A-J08, WHP2 Block A, Dubai Industrial City, Saih Shuaib 3, Dubai, UAE
Singapore	Emerging Travel Asia PTE. LTD	300 Tampines Avenue 5 #09-02, Tampines Junction, Singapore 529653
Italy	Emerging Travel Italy S.R.L.	Via Cosimo Del Fante 6, CAP 20122, Milan (MI), Italy
Brazil	Emerging Travel Brasil LTDA	Clelia Street, 2208, Suite 1707 Room 01, Agua Branca, São Paulo, 05042-001, Brazil

Pursuant to the GDPR, if the companies listed above, as controllers, are established outside the European Union, they have designated Leaside Services Limited as their representative in the European Union.

2. What We Collect & How We Use It

We process your personal data only to the extent necessary to achieve the specific purposes outlined below.

Our recruitment process is not directed to individuals under the age of 18, and we do not knowingly collect personal data from children. If we learn that such data has been collected without verifiable parental consent, we will take appropriate steps to delete it. The following table sets out the categories of personal data we collect, the purposes for which we process them, and the legal bases we rely upon under Applicable Data Protection Law:

Purpose of Processing	Categories of Personal Data	Legal Basis for Processing
Recruitment and Candidate Selection	Full name Email address Phone number Date of birth Address Resume/CV Cover letter, and any other documents you provide Education Employment history Experience Skills, professional qualifications Video interview (if applicable) Voluntary self-identification data (if applicable)	Contract
Publicly available information from professional networks (e.g., LinkedIn), public job boards, and databases provided by our recruitment platform provider (Workable)	Legitimate Interest(to find appropriate candidates and fill job openings)

3. Processing of Third-Party Data

When we receive personal data from someone other than the data subject, we make reasonable efforts to provide such data subjects with information about how their personal data is processed, including by making this information publicly available in this Privacy Notice. We also rely on the person providing the data to bring this Privacy Notice to the attention of those data subjects.

Therefore, if you provide us with personal data of other individuals, for example, referees, previous employers, or professional contacts, you must ensure that you are duly authorized to do so and, where appropriate, bring this Privacy Notice to their attention.

4. How We Share Your Data

To support the recruitment process and fulfill our obligations to you, we may share your personal data with the following categories of third parties:

• Affiliated Entities: we share data within the Emerging Travel Group for unified management, consolidated internal reporting, and centralized technical support.
• Government Authorities and Courts: we may disclose information to competent regulatory, tax, or law enforcement authorities and courts where disclosure is required by applicable law or necessary for the protection of our legal rights and defense against claims.
• Recruitment Platform Providers: we share data with third-party providers such as Workable, who power our recruitment systems and assist in collecting, managing, and processing applications.
• Data Centers and Cloud Service Providers: we use third-party infrastructure and hosting services to ensure the availability, security, and performance of our career website.
• Job Sites and Online Service Providers: information is shared with external job boards and online platforms through which you may have submitted your application.
• Background Verification and Reference Services: we engage specialized providers to assist with employment verification, background checks, and reference collection, where permitted by applicable law.
• Communication Service Providers: we use third-party communication tools to manage our interactions with you, including scheduling interviews and sending updates regarding your application.
• Referring Employees: if you have been referred by a current employee, we may (with your consent) inform that employee about the progress of your application and the final outcome of the recruitment process.
• Web Analytics Services: we use providers that collect statistical information about website visitor behavior to optimize the user experience.

We ensure that all third parties handle your personal data in compliance with Applicable Law and are bound by appropriate confidentiality and data protection obligations.

5. How We Transfer and Protect Your Data Internationally

As a global group of companies, we may transfer and process your personal data in various locations worldwide to provide you with the recruitment services.

Since these countries may have different data protection standards than your location, we implement the following safeguards in accordance with Applicable Law to ensure your information remains secure:

• When we share data with third-party service providers or partners, we include specific data protection clauses in our agreements, including Standard Contractual Clauses where applicable. These terms require all recipients to maintain a level of security and confidentiality that is substantially equivalent to the requirements of the Applicable Law governing our processing activities.
• We apply consistent technical and organizational measures across ETG globally. These standards are designed to meet the requirements of the Applicable Law and ensure a high level of data protection.
• We monitor and comply with specific legal conditions for cross-border data flows in each jurisdiction, including performing data transfer impact assessments or obtaining necessary authorizations where required by Applicable Law.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with Applicable Law. The specific retention period is determined based on the nature of the personal data, the purposes of processing, and applicable legal or regulatory requirements.

When the relevant processing purpose has been fulfilled and the applicable retention period has expired, personal data will be securely deleted or irreversibly anonymised.

If you request the deletion of your personal data or withdraw your consent, we will delete your information without undue delay. Please note that in certain cases our ability to delete personal data may be limited, for example, by statutory retention obligations, reasons of public interest, laws relating to freedom of expression and information, or where processing is necessary for the establishment, exercise or defence of legal claims.

7. What Are Your Rights

Under Applicable Law, you have certain rights that allow you to control how your personal data is used. The availability and exercise of these rights may vary depending on your location and the specific legal grounds for processing.

You may exercise the following rights by contacting us:

• Right of Access: you have the right to request confirmation as to whether your personal data is being processed and, where that is the case, access to the personal data and information regarding the processing (such as the purposes, categories of data, and recipients).
• Right to Rectification: you have the right to obtain the rectification of inaccurate or incomplete personal data concerning you without undue delay.
• Right to Erasure: you have the right to request the deletion of your personal data where the data is no longer necessary for the original purposes, or if you withdraw your consent. Please note that this right might be the subject to exceptions under Applicable Law (e.g., for compliance with a legal obligation).
• Right to Restriction of Processing: you have the right to request that we suspend the processing of your data, other than for storage purposes, in specific cases established by Applicable Law, such as when you contest the accuracy of the data, the processing is unlawful, the data is required for legal claims, or you have exercised your right to object and are awaiting verification of overriding legitimate grounds.
• Right to Data Portability: where processing is based on consent or a contract and carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format.
• Right to Object: you have the right to object to the processing of your personal data based on our legitimate interests, or where processing is necessary for the performance of a task carried out in the public interest.
• Right to Withdraw Consent: where processing is based on your consent, you have the right to withdraw it at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint: you have the right to lodge a complaint with a competent data protection supervisory authority in your jurisdiction if you believe our processing violates Applicable Law.

To exercise these rights, please refer to theHow to Contact Us section. We will respond to your request within the timeframe mandated by Applicable Law.

8. How We Keep Your Data Safe

We implement a comprehensive system of administrative, technical, and physical safeguards to protect your personal data against unauthorized access, disclosure, or destruction in accordance with Applicable Law.

Our security framework includes:

• We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption for data in transit and at rest. Our infrastructure is protected by advanced network security controls, including firewalls, intrusion prevention capabilities, and continuous threat monitoring. We also maintain application-level security controls designed to protect against common digital vulnerabilities and unauthorized access.
• Access to personal data is strictly limited to authorized personnel on a “need-to-know” basis. We enforce multi-factor authentication and role-based access controls across our systems.
• We maintain internal data protection policies, conduct regular security audits, and provide ongoing data security training for our employees. We also maintain third-party security certifications to verify our compliance with global standards.
• Your data is stored in secure data centers featuring 24/7 monitoring, restricted physical access, environmental controls, and robust disaster recovery and backup systems.
• We have established procedures for rapid incident response and breach notification to ensure that any potential threats are mitigated and reported as required by Applicable Law.

9. Use of Cookies and Similar Technologies

10. Updates to This Privacy Notice

We may update this Notice from time to time to reflect changes in our practices or legal requirements under Applicable Law. In the event of significant changes, we will provide you with appropriate notice. The “Updated” date at the beginning of this document indicates when the latest changes were made.

11. How to Contact Us

If you have any questions, concerns, or requests regarding your personal data, please contact our Data Protection Officer at[email protected].