Candidate Privacy Notice

This Privacy Notice explains how LuxExperience Group processes your personal data when you apply for a job with us.

1. Joint Controllers

For the purposes of the recruitment process, LuxExperience Group and the affiliated group companies involved in the recruitment activity act as joint controllers within the meaning of Article 26 GDPR and UK GDPR.

This means that the relevant group entities jointly determine the purposes and means of processing your personal data in connection with recruitment activities and the operation of the group recruitment system.

The joint controllers include in particular:

• LuxExperience B.V., Einsteinring 9, 85609 Aschheim, Germany – if you apply for a position at LuxExperience B.V.
• mytheresa.com GmbH, Einsteinring 9, 85609 Aschheim, Germany – if you apply for a position at Mytheresa.
• YOOX S.p.A., registered office at Via Morimondo 17, 20143 Milan, Italy, C.F. and P.IVA no. 02050461207 – if you apply for a position at YOOX.
• The NET-A-PORTER GROUP LTD, registered office at 1 The Village Offices, Westfield London, Ariel Way, London, W12 7GF, United Kingdom – if you apply for a position at Net-A-Porter in the UK.
• The Net-A-Porter Group Italy S.r.l., registered office at Via Morimondo 17, 20143 Milan, Italy, C.F. and P.IVA no. 14474810968 – if you apply for a position at Net-A-Porter in Italy.
• YNAP ME, registered office at Boulevard Plaza Tower 1, Office 2902, Burj Boulevard, Dubai, United Arab Emirates – if you apply for a position in the UAE.
• YNAP Corporation, registered office at Suite 905, 366 Fifth Avenue, New York, NY 10011, USA – if you apply for a position in the USA.
• YNAP Asia, registered office at 23rd Floor, Lee Garden Six, 111 Leighton Road, Causeway Bay, Hong Kong – if you apply for a position in Hong Kong SAR.

The joint controllers have entered into a Joint Controller Arrangement that allocates responsibilities for compliance with applicable data protection laws, including the handling of data subject rights and transparency obligations.

Under this arrangement, the group entity responsible for the specific vacancy generally manages the recruitment process and communication with candidates, while LuxExperience Group supports the operation of the global recruitment systems and recruitment framework.

This arrangement does not affect your right to exercise your data protection rights with any of the joint controllers.

For organisational efficiency, LuxExperience Group acts as the central contact point for privacy enquiries.

Contact: talents(at)luxexperience.com

2. Purpose of Processing

We process your personal data for the purposes of managing and conducting the recruitment process, including:

• reviewing and assessing your application
• communicating with you regarding vacancies and interviews
• conducting interviews, assessments and selection procedures, which may include the use of meeting technologies supporting automated note-taking, transcription or summarisation of interview discussions for internal recruitment documentation
• verifying qualifications, employment history and references
• carrying out background checks where legally permitted
• managing our recruitment systems and recruitment activities
• complying with legal or regulatory obligations

3. Categories and Sources of Personal Data

Depending on the stage of the recruitment process, we may process the following categories of personal data:

• identification and contact information (e.g. name, address, email, telephone number)
• professional and application information (CV, employment history, education, qualifications and skills)
• interview notes, assessments and evaluation results
• references from previous employers
• verification information (e.g. identity documents, right-to-work documentation)
• information from publicly available professional sources such as LinkedIn

We may also receive candidate information from recruitment agencies or publicly available professional platforms where permitted by applicable law.

Where required by law or necessary for specific roles, additional information may be processed, such as criminal record declarations or financial background checks.

Providing your personal data is voluntary; however, failure to provide certain information may affect our ability to evaluate your application.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Article 6(1)(b) GDPR / UK GDPR – processing necessary to take steps prior to entering into an employment contract
• Article 6(1)(c) – compliance with legal obligations (for example right-to-work verification)
• Article 6(1)(f) – legitimate interests
• Article 6(1)(a) – consent, where applicable (for example inclusion in a talent pool)

Our legitimate interests include operating an efficient recruitment process, identifying suitable candidates, verifying qualifications and professional experience, protecting the integrity of the recruitment process and preventing fraud or misuse of our recruitment systems.

Where special categories of personal data are processed, this will only occur where permitted under applicable law.

5. Recruitment Systems and Service Providers

We use carefully selected service providers (data processors) to support our recruitment process. These providers process personal data only on our instructions and are contractually required to implement appropriate security and data protection measures.

Workday

Our online application platform is provided by Workday, which hosts and processes candidate information on our behalf. Authorised employees of LuxExperience Group and its relevant group companies may access this system to manage recruitment activities.

Workday privacy information: https://www.workday.com/en-us/service-privacy.html

LinkedIn

If you apply using the “Apply with LinkedIn” feature, we receive the profile information you choose to share from your LinkedIn account.

LinkedIn privacy information: https://www.linkedin.com/legal/privacy-policy

Recruitment Agencies

For certain roles we may engage recruitment agencies or executive search firms. If you apply through such providers, they will process your personal data in accordance with their own privacy notices before sharing relevant information with us.

Background Checks

Where permitted by applicable law and relevant to the position, background screening may be carried out for candidates applying to specific Group entities.

Background screening is currently conducted for candidates applying to YNAP S.p.A. (soon to become YOOX S.p.A.) through Accurate Background UK Limited as the global background screening provider.

For candidates applying to Mytheresa Business Information Consulting Ltd. Shanghai, China, Dezan Shira & Associates (DSA) is engaged as an additional local provider to support the background screening process in compliance with local legal requirements.

Background checks are not conducted for candidates applying to the following entities:

• The Net-A-Porter Group S.r.l., Italy
• mytheresa.com GmbH branch, Italy
• mytheresa.com GmbH, Germany
• Mytheresa International Services GmbH, Germany
• Theresa Warenvertrieb GmbH, Germany
• Mytheresa Spain Services S.L.U., Spain
• Mytheresa US Services Inc., USA

Where a background check is required, you will be informed separately, and any notices or consents required under applicable law will be provided or obtained.

For more information on how our background screening providers process personal data, please refer to their privacy notices:

• Accurate Background UK Limited: https://www.accurate.com/uk/privacy-policy/
• Dezan Shira & Associates (DSA): https://www.dezshira.com/privacy-policy.html

6. International Data Transfers

As LuxExperience Group operates globally, your personal data may be transferred to group companies or service providers located outside the European Economic Area (EEA) or the United Kingdom.

Where such transfers occur, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission or UK authorities, or other legally recognised transfer mechanisms to ensure an adequate level of data protection.

7. Data Retention

We retain personal data only for as long as necessary for recruitment purposes and to comply with legal obligations.

• Successful candidates: application data becomes part of the employee personnel record and is retained during employment and for up to six years after employment ends, unless a longer retention period is required by law.
• Unsuccessful candidates: personal data is generally retained for up to 12 months after completion of the recruitment process.
• Talent pool: where you consent to remain in our talent pool, we may retain your data for up to 12 months in order to inform you about suitable future opportunities.

You may request deletion of your candidate profile or withdraw your application at any time by contacting us.

Aggregated and anonymised recruitment statistics may be retained for longer periods.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure.

Access to recruitment information is restricted to authorised personnel involved in the recruitment process.

9. Your Rights

Subject to applicable data protection law (GDPR and UK GDPR), you have the right to:

• access your personal data
• request correction of inaccurate or incomplete data
• request deletion of your personal data in certain circumstances
• request restriction of processing
• receive your personal data in a portable format
• object to processing based on legitimate interests
• withdraw consent at any time where processing is based on consent

Recruitment decisions are not based solely on automated decision-making within the meaning of Article 22 GDPR / UK GDPR. Applications are reviewed by human decision-makers.

To exercise your rights, please use the relevant privacy contact based on the entity you applied to:

• MYTHERESA: privacy(at)mytheresa.com
• YOOX (YNAP S.p.A.): dpo(at)yoox.com
• NET-A-PORTER entities: dpo(at)net-a-porter.com

10. Complaints

If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority, for example in the country where you reside, work, or where the alleged infringement occurred.