Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is a living natural person (rather than a legal entity, such as a company) who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Personal data about yourself that you provide to PepsiCo in the context of applying for a role with PepsiCo (the “Applicant Data”) will be used for recruitment purposes (as described in more detail below) and the Applicant Data will be processed in accordance with this Privacy Notice and any applicable laws.

We may collect various types of Applicant Data about you for the purposes described in this Privacy Notice, including:

• Identity information: such as name, gender, marital status, personal email, job title, nationality, passport number and visa information, home address, telephone numbers and previous residential address and languages spoken
• Recruitment data: such as education and training, qualifications, driving license number, CV and application, interview and assessment data, previous work history, prior PepsiCo role application history, recruitment interviewer notes
• Background data: such as references, vetting and verification information, information displayed on LinkedIn and other social media or public forums; and
• Feedback information: such as your feedback and opinions (e.g. surveys) on the recruitment process

In certain circumstances we may process personal data of third parties, such as referees. The personal data regarding third parties that you provide to us will be processed for the purposes of your application. Before you provide data relating to third parties to us, you should ensure you are permitted to do so and provide them with the information contained in this Privacy Notice.

PepsiCo collects and records your Applicant Data from a variety of sources, but mainly directly from you. You will usually provide this information directly to the PepsiCo Human Resources (HR) Talent Acquisition (TA) contact or otherwise provide it during the application and recruitment process.

In addition, PepsiCo may collect your responses to candidate experience surveys. Your decision to participate (or conversely not partake) in these surveys is entirely voluntary and will not impact your application.

In addition, further information about you will be generated by internal sources. This could include assessment results and interview feedback. This will include from materials created by the relevant TA specialist, interviewers, and the hiring manager. You may also be referred to us by an existing PepsiCo employee or partner.

In some cases, we may obtain your personal data from PepsiCo group companies or from third parties. This could include where your application is made through a recruitment agency or through a PepsiCo contact. We may receive information from other consultants and some information may be gathered from publicly available sources.

We may also obtain some information from other third parties, for example, references from a previous employer, tax authorities, benefit providers or in limited cases, where we employ a third party to carry out a background check (where permitted by applicable law).

Your Applicant Data is collected and processed for various business purposes, in accordance with applicable laws. We may collect and process your Applicant Data for various purposes, as set out in this Privacy Notice. Applicant Data may occasionally be used for purposes not anticipated by you where the circumstances warrant such use.

Where applicable data protection laws require us to process your Applicant Data on the basis of a specific lawful justification, we process your Applicant Data under one of the following bases:

• the processing is necessary for the legitimate interests pursued by PepsiCo, except where such interests are overridden by your interests or fundamental rights and freedoms.
• the processing is necessary for compliance with a legal obligation to which PepsiCo is subject; or
• the processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into such a contract.

We may on occasion process your Applicant Data for the purpose of the legitimate interests pursued by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.

We process your Applicant Data for the following purposes and for compatible purposes:

1. Recruitment and selection - This processing is necessary to take steps at your request to enter a contract of employment. This processing is also necessary for the purpose of the legitimate interests pursued by PepsiCo.
2. Appropriate vetting including, where relevant and appropriate, credit checks, right to work verification, identity fraud checks, criminal record checks (if and to the extent permitted by applicable laws), relevant employment history, relevant regulatory status, and professional qualifications - this processing is necessary for compliance with legal obligations to which PepsiCo is subject. This processing is also necessary for the purpose of the legitimate interests pursued by PepsiCo.
3. Improving business processes, including reviewing our recruitment processes and tools. This processing is necessary for the purpose of the legitimate interests pursued by PepsiCo.
4. Recruitment planning, including the use of the Applicant Data to create profiles (“Applicant Profiles”) to be included within the PepsiCo Talent Community to enable Pepsico to consider you for any suitable positions that become available in the future - this processing is necessary for the purpose of the legitimate interests pursued by Pepsico, but is only conducted where you continue to consent to receiving such notifications.

Pepsico considers that it has a legitimate interest in:

• Fully assessing applications for employment to ensure that only suitable and appropriate candidates are both assessed and selected.
• Considering all suitable applicants for roles which may become available; and
• Improving business processes and increasing efficiencies.

You should ensure not to include any personal information in your CV or other materials that you submit to Pepsico that you do not wish to be used for these purposes.

To the extent permitted by applicable laws, Pepsico may also collect and process a limited amount of Applicant Data falling into special categories, sometimes called “sensitive personal data”. This term includes information relating to such matters as racial or ethnic origin, religious beliefs, physical or mental health (including details of accommodations or adjustments), certain maternity/adoption information, trade union membership, sexual orientation, information regarding sexual life, biometric data and/or genetic data.

As part of the recruitment process, we may process the following special categories of Applicant Data:

• Disability (in order to make necessary adjustments for interviews when requested)
• Race & Ethnicity as part of our commitment to a fully inclusive and diverse workplace. These will only be used in aggregated outputs.
• Biometrics for the purposes of identity verification/’Right to Work’
• Criminal Records information

The sensitive or special categories of Applicant Data that may be processed by Pepsico are set out in this Privacy Notice. Where applicable data protection laws require us to process such special categories of Applicant Data based on a specific lawful justification, we do so under one of the following bases:

• The processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or Pepsico in the field of employment law, social security, and social protection law, to the extent permissible under applicable laws.
• The processing is necessary for the establishment, exercise, or defence of legal claims.

In particular, we process special categories of applicant data in order to carry out diversity monitoring (at an aggregated level), make adjustments for you during the recruitment process and to comply with our obligations under various employment laws.

Pepsico will seek your consent to certain processing which is not otherwise justified under one of the above bases. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with any impact of not providing any such consent. You should be aware that it is not a condition or requirement of your application to agree to any request for consent from Pepsico.

Within Pepsico, your personal data can be accessed by or may be disclosed internally on a need-to-know basis to:

• local, regional, and global HR, including managers and team members.
• local, regional, and executive management responsible for managing or making decisions in connection with the relevant recruitment exercise (including, without limitation, staff from the division and geography that you have applied to).
• local and regional support services (such as travel bookings and other support services) and personal assistants.
• system administrators; and
• where necessary for the performance of specific tasks or system maintenance by staff in Pepsico teams such as the Finance and IT Department and the Global HR information systems support team.

Your personal data may also be shared with certain interconnecting systems. This includes sharing data with external partners for applicant online testing purposes. Data contained in such systems may be accessible by providers of those systems, their affiliates, and sub-contractors such as their online support and maintenance teams.

Pepsico, its sub-contractors or agents may process your Applicant Data on the basis set out in this Privacy Notice. This may include authorised Pepsico employees, IT support, and iCIMS support (PepsiCo's appointed contractor who run the Pepsico recruitment platform). Due to the size and complexity of PepsiCo's operations it is not possible to name each of our data recipients in this Privacy Notice. Pepsico expects such third parties to process any data disclosed to them in accordance with applicable law and appropriate contractual clauses relating to data protection, including with respect to data confidentiality and security.

At times, Pepsico may be required to transfer Applicant Data to selected external third parties that have been contracted to perform certain employment-related services on PepsiCo's behalf. These third parties will process the data in accordance with PepsiCo’s instructions or make decisions regarding the data as part of the delivery of their services. In either instance, Pepsico will select reliable suppliers who undertake, by contract or other legally binding and permissible means, to put in place appropriate security measures to ensure an adequate level of protection. Such selected third parties will have access to Applicant Data solely for the purposes of performing the services specified in their applicable service contract with Pepsico.

Pepsico may be required to disclose certain Applicant Data to other third parties, including but not limited to governmental authorities, (1) as a matter of law (e.g., to tax and social security authorities); (2) to protect PepsiCo’s legal rights; (3) in an emergency where the health or security of an Applicant or Applicant Data is endangered; or, (4) for any other purpose required by applicable laws.

The personal data you provide to Pepsico may be shared for recruitment purposes with one or more Pepsico companies throughout the world each of which is an independent legal entity and is acting as data controller. This means that the personal data may be accessible by Pepsico companies outside of the country in which you are located. In some cases, the local laws regarding data protection will not necessarily be as strong as they are in the country in which you are located. However, Pepsico will ensure that if information is transferred outside your country of residence, it will still be treated in accordance with this Privacy Notice

Where required by applicable data protection laws, Pepsico has ensured that any transfers to service providers or other Pepsico associated companies outside the EEA (European Economic Area) or UK (United Kingdom) (or other countries which have been assessed as providing an adequate level of data protection by the European Commission or other supervisory authority) are made under the terms of standard contractual clauses as approved by the European Commission or other supervisory authority with jurisdiction over the relevant data exporter. You can obtain a copy of any standard contractual clauses in place which relate to transfers of your personal data by contacting the Pepsico Europe Privacy Office at europe.privacy@pepsico.com (please note that some details may be redacted for confidentiality reasons).

Pepsico endeavours to ensure that irrelevant or excessive data are deleted or made anonymous as soon as reasonably practicable. However, some Applicant Data may be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons.

It is PepsiCo's policy to retain your application and profile information for either a period of 2 years post application, or (subject to some exceptions) until you decide to delete your personal details (see ‘Your Rights’); whichever comes sooner.

Pepsico uses a variety of technical and organisational methods to secure your Applicant Data in accordance with applicable laws. Pepsico is committed to protecting the security of the Applicant Data you share with us. In support of this commitment, we have implemented appropriate technical, physical, and organisational measures to ensure a level of security appropriate to the risk.

You may be entitled under the applicable data protection laws to the following rights in respect of your personal data:

1. Information and access: You have the right to be provided with certain information about PepsiCo's processing of your personal data and access to that data (subject to exceptions).
2. Rectification: If your personal data changes, we encourage you to inform us of the change. You have the right to require inaccurate or incomplete personal data to be updated or corrected.
3. Erasure: You have the right to require that your data be erased in certain circumstances, including where it is no longer necessary for us to process this data in relation to the purposes for which we collected or processed the data, or if we processed this data on the basis of your consent and you have since withdrawn this consent.
4. Data portability: Where we process your personal data on the basis of your consent, or where such processing is necessary for entering into or performing our obligations under a contract with you, you may have the right to have the data transferred to you or another controller in a structured, commonly used, and machine-readable format, where this is technically feasible.
5. Right to object to certain data processing: Where Pepsico is relying upon the legal basis of legitimate interest to process your personal data, then you have the right to object to such processing, and Pepsico must stop such processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms or where Pepsico needs to process the data for the establishment, exercise, or defence of legal claims. Where Pepsico relies upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.
6. Right to restriction of processing: You have the right to restrict PepsiCo's processing of your personal data while your request for data rectification or objection to personal data processing is being considered, if we no longer need to process your data but you need that data in connection with a legal claim, or if our processing is unlawful but you do not want us to erase the data. If this right applies, we will continue to store your data but will only further process it with your consent, for the establishment, exercise, or defence of legal claims, to protect the rights of another person, or for reasons of important public interest.
7. Right to withdraw consent: To the extent that Pepsico is relying upon your consent to process personal data, you have the right to withdraw such consent at any time.
8. Complaint: You also have the right to lodge a complaint with a supervisory authority, in particular that in your Member State of residence, where applicable.

You may make a request to exercise any of the rights set out above by using this link or alternatively you can utilise the Data Subject Request facility on the Careers website.

Once you accept a job offer from PepsiCo, we begin a process referred to as “onboarding”. As part of the onboarding process, you will be requested to provide additional elements of your personal data to facilitate a smooth transition into your first day of employment with PepsiCo. Examples of such data can include but are not limited to:

• Home address for the delivery of IT equipment
• Bank details for salary payment
• ‘Right to Work’, Visa or Passport scans to verify your identity

From Day 1 of your employment your personal data will then be governed by the PepsiCo Employee Notice, a copy of which will be made available to you digitally or through your local Human Resources (HR) representative.

When you view one of our sites or advertisements, we may store some information on your computer. For example, this information may be in the form of a "Cookie" or similar file that can enhance your user experience or assist in continuing with a previously saved application.

Pepsico will notify you of such cookies in the form of a pop-up banner where you are then able to consent, deny or set your cookie preferences.

PepsiCo will ensure that the terms of this Privacy Notice are observed and that all persons who have access to Applicant Data will comply with the terms of this Privacy Notice. If at any time, you have any questions regarding your personal data or this Privacy Notice, you may contact the PepsiCo Europe Data Protection Officer at: dpo-europe@pepsico.com