Recruitment
PRivacy Notice

Tenpoint Therapeutics Holding Limited and its subsidiaries, affiliates, and related entities (collectively, “Tenpoint”, “we”, “our”, or “us”) take the protection of Personal Data (as defined below) seriously. This Recruitment Privacy Notice (“Notice”) describes Tenpoint’s processing of Personal Data of candidates and job applicants (“Applicant” or “you”) who are based in the UK or Switzerland.

For the purposes of this Notice “Personal Data” means any information related to an identified or identifiable individual. This Notice describes the categories of Personal Data that we collect, how we use your Personal Data, how we secure your Personal Data, when we may disclose your Personal Data to third parties, and when we may transfer your Personal Data outside of your home jurisdiction. This Notice also describes your rights regarding the Personal Data that we hold about you including how you can access, correct, and request erasure of your Personal Data.

Please read this Notice carefully. This Notice may be updated from time to time to reflect changes to our Personal Data practices, and we will notify you of any significant changes.

1. Personal Data We Collect
Below we list the categories of Personal Data that we may collect, store and process for the purpose of administering the employment application process:

• Personal contact details such as name, title, addresses, telephone numbers, and email addresses;
• Date of birth;
• Gender;
• Current and previous employment details (such as salary/bonus and employee benefits schemes, employment with government or regulator, potential conflicts of interests from Applicant or Applicant’s relatives, and other potential restrictions for employment such as non-compete or non-disclosure agreements, and including professional memberships, and proof of work eligibility);
• Education and training (such as your university or school diplomas/certificates and other educational achievements);
• Immigration status and work permits;
• Languages spoken and level of proficiency;
• Job preferences and requirements, including willingness to travel and/or relocate, and roles under consideration;
• Any video/photo images or audio recordings that you voluntarily submit to us in connection with your job application and that will be withdrawn at your request;
• Expenses incurred during the job selection process, and information required to reimburse you for thesame (where applicable);
• Results of the selection and job matching process;
• Any other information which you decide to submit to us, including when you submit an application to us through a third party service such as LinkedIn.

Where applicable, we indicate whether it is mandatory to provide us with your Personal Data in order for us to administer the employment application process. Failure to provide or allow us to process mandatory Personal Data may affect our ability to accomplish the purposes stated in this Notice.

We collect the majority of the Personal Data that we process directly from you. In limited circumstances third parties may provide your Personal Data to us, such as former employers, personal references, educational institutions, and/or official bodies (such as regulatory or law enforcement authorities).

2. How We Use Personal Data
We may process your Personal Data for the following purposes:

• 1. Recruitment: To receive, evaluate, and process job applications, verify your information and conduct background checks as permitted by law, communicate with you about the recruitment process and your application, schedule interviews, and improve the recruitment process.
• 2. Legal and Compliance: To comply with legal obligations; process conflict of interest reporting; gather evidence for and to support any internal investigations, litigation, or related activities; protect, enforce, and defend the legal rights, privacy, safety, or property of us and our employees, agents, and contractors; protect against fraud and manage risk; comply with health and safety obligations; and comply with applicable laws, regulations, legal processes or enforceable governmental requests.
• 3. Other Legitimate Business Purposes: For other purposes that you would reasonably expect (including, for example, to conduct data analytics analyses to review and better understand the application process), or for which we provide specific notice at the time the information is collected.

3.Legal Ground for the Use of your Personal Data
We only process your Personal Data where applicable law permits or requires it, including where the processing is necessary to comply with a legal obligation that applies to us, or for our legitimate interests or the legitimate interests of third parties.

4. Collection and Use of Sensitive Personal Data
Tenpoint may process sensitive data (i.e., Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, data concerning health, or sex life, or sexual orientation, in some cases biometric data, and data relating to criminal convictions and offences or related security measures) of Applicants where you voluntarily provide this data.

If we proceed to make you an offer of employment, we may carry out certain verification checks in accordance with applicable law. At that point, we will provide you with further information on the nature of these checks.

Where we have a need to process sensitive Personal Data about you for purposes not identified above, we will only do so only after providing you with notice and, if required by law, obtaining your prior, express consent.

5. Data Sharing
We may disclose your Personal Data to third parties where required by law or to our employees, contractors, designated agents, or third-party service providers who require such information to assist us with administering our recruiting and hiring processes, including third-party service providers who provide services to us or on our behalf. Third-party service providers may include, but are not limited to:

• IT service providers, and data storage or hosting providers;
• Employment service providers,including providers of recruiting and hiring platforms;
• Auditors, accountants, forensic investigators or law firms, for group, statutory or other periodic audits, oras part of an investigation of suspected illegal activity.

We may also disclose your Personal Data in the following situations, where permitted by applicable law:

• To other members of our group of companies (including outside of your home jurisdiction) for the purposes set out in this Notice;
• To comply with legal obligations or valid legal processes. When we disclose your Personal Data to comply with a legal obligation or legal process, we will take reasonable steps to ensure that we only disclose the minimum Personal Data necessary for the specific purpose and circumstances;
• To protect the rights and property of Tenpoint;
• During emergency situations or where necessary to protect the safety of persons;
• Where the Personal Data is publicly available;
• If a business transfer or change in ownership occurs and the disclosure is necessary to complete the transaction. In these circumstances, we will take reasonable steps to limit data sharing to what is necessary, and to de-identify the data where possible;
• For additional purposes, with your consent, where such consent is required by law.

6. Cross-Border Data Transfers
Where permitted by applicable law, we may transfer the Personal Data we collect about you to other jurisdictions that may not be deemed to provide the same level of data protection as your home country. If you are located in the UK or Switzerland, we may transfer your Personal Data to countries that have not been found by the UK or Swiss government to provide adequate protection. Where such transfers occur, we have implemented appropriate arrangements (e.g., standard data protection clauses) to secure the transfer of your Personal Data to the United States and other jurisdictions. You may contact us as specified below to obtain further details about how we transfer your Personal Data outside the UK or Switzerland.

7. Data Security
We have implemented appropriate physical, technical, and organizational security measures designed to secure your Personal Data against accidental loss and unauthorized access, use, alteration, or disclosure. In addition, we take reasonable steps to limit access to Personal Data to those employees that have a legitimate business need for such access.

8. Data Retention
Except as otherwise permitted or required by applicable law, we will only retain your Personal Data for as long as necessary to fulfill the purposes we collected it for, as required to satisfy any legal, accounting, or reporting obligations, or as necessary to resolve disputes. To determine the appropriate retention period for Personal Data, we consider our statutory obligations, the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes we process your Personal Data for, and whether we can achieve those purposes through other means.

Under some circumstances we may anonymize your Personal Data so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent.

9. Rights
It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during the hiring process.

Depending on where you reside, you may have the right to request access to, a copy of, correction, and erasure of the Personal Data that we hold about you, or object to the processing of your Personal Data under certain circumstances. You may also have the right to request that we transfer your Personal Data to another party or restrict the processing of your Personal Data. In addition, you have the right to lodge a complaint with the supervisory authority of your habitual residence, your place of work or the place of an alleged infringement.

Where you have provided your consent to the collection, processing, or transfer of your Personal Data, you may have the legal right to withdraw your consent under certain circumstances. Withdrawing your consent does not affect the lawfulness of processing based on consent before its withdrawal.

If you wish to exercise any of these rights, please contact us at . When processing your request, we may ask you to provide us with reasonable information to help us confirm your identity.

Please note that these rights may be limited in some circumstances by local law. Also, we may need to retain certain information for record-keeping or legal compliance purposes.

10. Updates to this Notice
This Notice may be modified periodically. If you have any questions about this Notice, you may contact us as indicated below.

11. Contact Information
If you have any questions, comments, or concerns about our processing activities,please contact hr@visustx.com.

Last Updated: February 4, 2025