Privacy Statement – Prospective Applicants (Avature)

At Novo Nordisk (“Novo Nordisk” or “Us” or “Our” or “We”), We strive to make a difference and improve the lives of millions of people living with diabetes, obesity and other serious chronic diseases around the world. Being an industry leader in Corporate Social Responsibility, We respect and value your personal privacy.

We want you – as someone interested in a career at Novo Nordisk – to understand who We are, what information We will collect from you, and how We process your personal data, sometimes also referred to as personal information. This privacy statement (“Statement”) is designed to provide you with transparency into our privacy practices and principles and to inform you of your individual rights.

We also want you to understand that each Novo Nordisk entity complies with all applicable privacy laws and regulations in their respective locations. This means that you may have different privacy rights depending on the country in which you express interest in working and the specific Novo Nordisk affiliate processing your personal data.

We reserve the right to modify this Statement at any time. When We make changes to this Statement, you will be required to acknowledge that you have read and understand the revised privacy statement when expressing interest. If you are unable to review or access this Statement due to a disability, you may contact globalrecruitsupport@novonordisk.com to access this notice in an alternative format.

We ask that you read this Statement carefully and acknowledge that you have read and understand its terms by following the prompts at the end of this document. For purposes of this document, the legal bases of processing your Personal Data will follow the regulatory requirements at your country or region of residence and/or the Novo Nordisk location where you expressed interest in working (please refer to the grid in section A.5 below).

If you reside in a country or region where the legal basis for the processing is consent, you are not required to consent to the processing. When you submit your personal data to us as part of this process, it is considered as your consent. You are not obligated to provide us with your personal data. However, if you do not provide your Personal Data, We will not be able to include you in talent processes such as talent community communications, notifications about upcoming opportunities or general engagement outreach by our Talent Attraction team for opportunities in which you might have interest.

Privacy Statement – Prospective Applicants (Avature)

Respect to the Processing of Your Personal Data

You can always contact Novo Nordisk A/S, the specific Novo Nordisk entity receiving your data or the Novo Nordisk Data Privacy Officer at privacy@novonordisk.com with questions or concerns about how We process your personal data.

If you reside in California, United States you can learn more about our privacy practices involving prospective applicants at California Applicant Employee Privacy Notice.

Personal Data Held by Novo Nordisk

Novo Nordisk collects personal data submitted by you as part of the prospect recruitment process. As used in this Statement, “personal data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual. In some jurisdictions, a link to solely a household may also be personal data. Your personal data is held on an externally hosted database located in the United States. Your personal data is also held in manual form and on other internal computer systems.

Further, your personal data, if necessary, for the below purposes, will be transferred to non-affiliated parties providing products and services (such as agencies assisting Novo Nordisk in screening and interviewing prospective employees and recruitment process vendors) and IT system suppliers, as well as regulatory authorities if required by law. When these are acting as data processors, contractual agreements are put in place to safeguard your personal data.

Purposes for Which Personal Data is Held by Novo Nordisk

As part of the prospect recruitment process, your personal data may be transferred to Novo Nordisk entities located in a different country from your country of residence. We believe that it is beneficial to form an ongoing relationship with individuals who might be a good fit for current or future positions at Novo Nordisk. In order to further this effort, we work to provide you with information about Novo Nordisk and opportunities here as well as learn more about your career aspirations and needs. That allows us to present opportunities that you might have interest in even if you are not aware and have not applied.

In addition to the purposes identified above, Novo Nordisk will also use the data as we believe to be necessary or appropriate:

• (a) to comply with applicable law, including laws outside your country or region of residence;
• (b) to comply with legal process;
• (c) to respond to requests from public and government authorities including public and government authorities outside your country or region of residence if it complies with relevant legislation;
• (d) to enforce our terms and conditions or policies and procedures if it complies with relevant legislation;
• (e) to protect or defend our operations or those of any of our affiliates if it complies with relevant legislation;
• (f) to protect or defend our rights, privacy, safety, or property, and/or that of our affiliates, you, or others if it complies with relevant legislation;
• (g) to allow us to pursue available remedies or limit the damages that we sustain if it complies with relevant legislation.

What Personal Data We Process About You

To facilitate the recruitment related processes highlighted above, We collect and process information in Our talent acquisition systems, which contain:

All areas except US and Canada will collect some or all the information listed below:

• Contact information (name, address, telephone number, e-mail address).
• Curriculum Vitae or resume, including work experience, qualifications, skills, and education history.

US and Canada will collect some or all the information listed below:

• Contact information (name, address, telephone number, e-mail address).
• Curriculum Vitae or resume, including work experience, qualifications, skills and education history.

The information that you submit to our online recruiting system, will be used for Novo Nordisk’s recruitment processes, as permitted by local law, including to:

• Assess your capabilities and qualifications for a job;
• Provide you updates/notifications about opportunities that match your capabilities and qualifications if you have agreed to receive these updates;
• Comply with or monitor compliance with any applicable law or regulation or Novo Nordisk policies or procedures.

The legal basis for the processing of your personal data

Our processing of your personal data requires a legal basis. Where permitted by applicable laws, Novo Nordisk has a legitimate interest in the processing of your personal data to carry out the prospect recruitment process. Other legal bases allowing collecting and processing of personal data are consent (explicit or implied) or legal obligation.

If you would like to know more about Novo Nordisk´s legal obligation for collecting and processing your personal data in relation to your location, please contact privacy@novonordisk.com.

As a general matter, your personal data will be disclosed only in limited circumstances. If your personal data must be transferred outside of the country or region in which you reside, we will protect your personal data and will implement certain safeguards consistent with applicable privacy laws. Those safeguards are as follows:

• Transfers of EU personal data to a Novo Nordisk entity are covered by Novo Nordisk’s Binding Corporate Rules, available at Novo Nordisk’s Binding Corporate Rules.
• Some transfers will be limited to destination countries that are deemed by applicable privacy laws (such as by the EU Commission under the EU General Data Protection Regulation) as having an adequate level of protection of personal data.
• Where legally required, we will make sure to have entered into Standard Contractual Clauses that are prescribed under applicable privacy laws (such as those prescribed by the EU Commission or the UK Information Commissioner’s Office) before we transfer personal data to any entities located in third countries. You can get a copy of the clauses by contacting us as described in section 1.
• In certain situations, we will also implement other mechanisms approved by relevant regulators under applicable privacy laws.

As described above, you also understand that your personal data will be stored in the United States and will be subject to the data privacy and protection laws and regulations governing the Novo Nordisk entity to which you’ve expressed interest.

Disclosure of Personal Data

As a general matter, your personal data will be disclosed only in limited circumstances. Personal data will be disclosed to the extent required for the purposes listed in section 3 above to Novo Nordisk entities/Talent Acquisition supporting teams globally, including affiliates located in countries other than where you reside. These locations may have different data privacy laws and regulations from your country or region of residence.

Additionally, your personal data will be disclosed to external vendors as described in section 2, public authorities and law enforcement agencies as required or permitted by all applicable laws.

Data Retention

Novo Nordisk will retain personal data for the period necessary to fulfil the purposes outlined in this Statement unless a longer retention period is required or permitted by law. We will also retain your data to consider whether your skills are suitable for other opportunities, in which case we would invite you to apply. Depending on if you have defined specific affiliates/entities you are interested in, your personal data will be retained for up to 8 years after submission. Furthermore, Novo Nordisk will delete personal data about you (including your CV/resume) from our database at any time and without providing any reason. Therefore, please retain a copy of your personal data.

Storage and Deletion of Data

We ask you to provide accurate and up-to-date information and you may request to update it or for deletion of it at any time.

Your Privacy Rights

Because Novo Nordisk values the importance of your personal data that it collects from you and strives to give you as much control over it as possible, we recognize that you may be entitled to one or more of the following data subject rights depending on the applicable laws in countries or regions where you reside. Please note that some rights only apply to residents of certain geographies. In those instances, we have added language indicating which rights only apply to residents of certain geographies:

• Right to Receive Information on Privacy Practices: You have the right to receive certain legally required information at or before the point of collection or in response to your request.
• Right to Erasure: You may request that we delete any personal data about you that we Collected from you, subject to certain exceptions.
• Right to Rectification: You may request that we correct any inaccurate personal data we maintain about you.
• Right to Know and Access: You may request that we provide you with specific information about how we have handled your personal data, including providing you with a copy of the specific pieces of personal data we have collected about you in a portable format.
• Right to Non-Discrimination (for California Residents only): You have the right not to be discriminated against for exercising your data subject rights. That means not retaliating against you as a result of you exercising your data subject rights.
• Rights to Opt-Out (for California Residents only): You may request to opt-out of the sale and sharing of your personal data, cross-context behavioral or targeted advertising, automated decision making or profiling, to the extent such activities are defined and restricted under applicable laws. When we collect your personal data during the recruitment process, we do not use your personal data for any of these restricted purposes.
• Right to Restrict or Object to Processing (for EU Residents only): You may request us to suppress or cease the processing of some of your personal data but we may still store your personal data.
• Right to Lodge a Complaint (for EU Residents only): You have the right to file a complaint with your local data protection authority if you consider that the processing of personal data relating to you infringes upon your rights.
• Right to Withdraw Consent (for EU Residents only): Please note that if you apply for a position in a country or region where the legal basis for the processing of your personal data includes consent, you reserve the right to withdraw your consent at any time. Novo Nordisk will honor this request for any future processing to the extent required by applicable laws, but will not be able to modify any previous processing of personal data done before we have received your revocation of your consent.

For further information about what local requirements apply to you and to exercise your privacy rights, you can always contact us as follows:

For prospects in the United States: Please e-mail the Novo Nordisk US Privacy Office at NNIPrivacy@novonordisk.com

For prospects everywhere else: Please e-mail the Novo Nordisk data privacy officer at privacy@novonordisk.com

Statistics

We may anonymize or aggregate your personal data as permitted by applicable laws for internal purposes only, including, but not limited to, statistical analysis about trends relating to responses to job postings and for other statistics and reporting purposes.

Data Security

Novo Nordisk implements organizational, technical, and administrative measures to protect personal data within our organization. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us of the problem by contacting us in accordance with the “Contact us” Section above.

Do not send sensitive data to us via e-mail. It is your sole responsibility to use the appropriate level of care whenever you communicate with us.

Links to Non-Affiliated Websites

This online recruiting system may contain links to other websites. This Privacy Statement does not address, and we are not responsible for, the privacy, data, or other practices of any non-affiliated parties, including any non-affiliated party operating any website or service to which this online recruiting system links. The inclusion of a link on this online recruiting system does not imply endorsement of the linked site or service by Novo Nordisk or our affiliates. We encourage you to read the legal notices posted on those sites, including their privacy policies.

About Children

This online recruiting system is not intended for minors under the age of 16.