Version 2.0 | Last Updated: 26/02/2026

1. Who We Are

Rhumbl Group Pte. Ltd. ("Rhumbl", "we", "us", "our") is a professional executive search firm incorporated in Singapore (UEN: 202542983W). We are committed to protecting the privacy and personal data of all individuals we interact with in the course of our work, including candidates, potential candidates, and referees.

This notice explains how we collect, use, store, share, and protect your personal data when you engage with us in connection with an executive search assignment, whether you have approached us directly or we have approached you. Please read this notice carefully.

For data protection purposes, Rhumbl acts as an independent data controller in respect of your personal data. This means we are responsible for deciding how and why your personal data is processed and for ensuring that processing is carried out lawfully, fairly, and transparently.

For our designated point of contact for data protection matters:

Email: dpo@rhumblgroup.com Address: 160 Robinson Road, #14-04 SBF Center, S068914.

2. What Personal Data We Collect

We may collect and process the following categories of personal data about you:

Identity and contact information, including your full name, job title, current employer, email address, telephone number, and LinkedIn or other professional profile information.

Professional and career information, including your employment history, qualifications, educational background, professional achievements, areas of expertise, career aspirations, and any other information you choose to share with us about your professional background.

Compensation information, including your current and expected remuneration, benefits structure, and notice period, where you choose to provide this information to us.

References and assessments, including information provided by referees you have nominated, our own professional assessment notes, interview evaluations, and any psychometric or other assessment results where applicable.

Communication records, including records of our correspondence and conversations with you in connection with any assignment, whether by email, telephone, video call, or in person.

Publicly available information, including information sourced from professional networking platforms such as LinkedIn, company websites, industry publications, professional directories, and other publicly accessible sources.

We do not routinely collect sensitive personal data such as health information, racial or ethnic origin, religious or philosophical beliefs, trade union membership, biometric data, or criminal record information. Where such information is relevant to a specific assignment and you choose to provide it, we will obtain your explicit consent before processing it and will handle it with additional care and appropriate safeguards. You are never required to provide sensitive personal data to us.

3. How We Collect Your Personal Data

We collect your personal data in the following ways:

Directly from you, when you contact us, respond to our outreach, submit your CV or professional profile, attend an interview or assessment, complete any forms we send you, or otherwise communicate with us in connection with an assignment.

From publicly available sources, including professional networking platforms such as LinkedIn, company websites, industry directories, published biographical information, press releases, and other publicly accessible professional information.

From third parties, including referees you have nominated, members of our professional networks who refer candidates to us, and in some cases our clients where they refer individuals to us directly.

Through our own research activities, as part of our executive search methodology, where we identify and approach individuals who may be suitable for specific senior assignments based on their publicly available professional profile and our knowledge of relevant industries and talent markets.

4. Why We Use Your Personal Data and Our Lawful Basis

We process your personal data for the following purposes and on the following legal bases:

To assess your suitability for executive search assignments We process your professional and career information to evaluate whether you may be a suitable candidate for current or future assignments we are conducting on behalf of our clients. Where we are subject to GDPR or UK GDPR, we rely on our legitimate interests in conducting professional executive search services as our lawful basis for this processing. We have conducted a Legitimate Interests Assessment confirming that this processing is proportionate and does not override your fundamental rights and freedoms. A copy of our Legitimate Interests Assessment is available upon request.

To introduce you to our clients Where we consider you to be a suitable candidate for a specific assignment, we may share your personal data with the relevant client. We will make you aware of the specific opportunity before disclosing your identity to the client, except where you have provided broader consent for us to do so or where disclosure is limited to anonymised profile information at an early stage of the search process. We rely on our legitimate interests and, where required, your consent for this purpose.

To manage our ongoing professional relationship with you We retain your information to keep in touch with you about relevant future opportunities, to maintain accurate records of our professional interactions, and to provide you with a consistent and professional experience across engagements. We rely on our legitimate interests for this purpose.

To conduct reference checks Where you are an active candidate and have provided referees, we will contact those referees to verify your professional background and obtain assessments relevant to the assignment. We rely on our legitimate interests and your implicit consent in providing referee details for this purpose.

To comply with our legal obligations We may process your personal data where required to comply with applicable laws, regulations, or legal proceedings.

To respond to your enquiries Where you contact us directly with a question or request, we process your personal data to respond to you. We rely on our legitimate interests or, where appropriate, steps taken at your request prior to entering into a contract for this purpose.

Where we rely on legitimate interests as our lawful basis, you have the right to object to that processing at any time. Please see Section 8 for details of how to exercise this and your other rights.

5. How We Share Your Personal Data

We may share your personal data with the following categories of recipients:

Our clients, where we consider you to be a suitable candidate for a specific assignment. We will not share your identity with a specific client without first making you aware of the relevant opportunity, except where you have provided general consent or where sharing is limited to anonymised information at the research stage of the process.

Our technology and service providers, including providers of applicant tracking systems, candidate relationship management platforms, video interview tools, cloud storage, and communication platforms that we use to operate our business. These providers act as processors on our behalf and are subject to written data protection obligations consistent with our obligations under this notice and our Data Processing Addendum.

Professional referees, where you have nominated referees and we have your consent to contact them in connection with a specific assignment.

Regulatory and legal authorities, where we are required to disclose personal data by law, court order, or legitimate regulatory requirement.

Professional advisers, including lawyers and auditors, where disclosure is necessary for the purposes of obtaining professional advice or in connection with legal proceedings.

We do not sell your personal data to any third party under any circumstances. We do not share your personal data with clients for any purpose other than the specific assignment for which you are being considered, nor do we use your data for any form of advertising or non-executive-search-related marketing.

6. International Transfers

Rhumbl is incorporated and operates from Singapore and your personal data will primarily be processed and stored there. In the course of providing executive search services, your personal data may be transferred to or accessed from other countries, including countries where our clients or technology providers are based.

Where your personal data is subject to GDPR or UK GDPR and is transferred to Singapore or any other country not recognised by the European Commission as providing an adequate level of data protection, we will ensure that appropriate safeguards are in place before making that transfer. These safeguards may include:

• Standard Contractual Clauses approved by the European Commission

• The International Data Transfer Agreement approved by the UK Information Commissioner's Office, for transfers subject to UK GDPR

• Other transfer mechanisms approved under applicable law

Where transfers are subject to Singapore's Personal Data Protection Act 2012 ("PDPA"), we will ensure that any recipient of your personal data outside Singapore provides a standard of protection comparable to that required under the PDPA.

You may request further information about the specific transfer mechanisms we rely on in relation to your personal data by contacting us using the details set out in Section 10.

7. How Long We Keep Your Personal Data

We retain your personal data only for as long as is necessary to fulfil the purposes set out in this notice, to maintain accurate professional records, and to comply with our legal, regulatory, and contractual obligations. The appropriate retention period is determined by reference to the nature and sensitivity of your data, the purpose for which it was collected, any applicable legal or regulatory requirements, and the potential need to establish, exercise, or defend legal claims.

As a general principle:

• Your professional profile and assessment information is retained for a reasonable period following our last meaningful interaction with you, sufficient to support ongoing and future search activities where relevant

• Where you are successfully placed with a client through Rhumbl, relevant records are retained for a reasonable period following the conclusion of that engagement

• Records of our correspondence and conversations with you are retained for a reasonable period following the conclusion of our professional relationship

• Information provided by referees is retained for the duration of the relevant assignment and for a short period thereafter unless it forms part of a wider candidate record

In all cases, your personal data is securely deleted or anonymised when it is no longer required for any of the above purposes. At any time you may request further information about the retention period applicable to your personal data, or request early deletion of your data, by contacting us using the details in Section 10, subject to any legal obligation we may have to retain certain records. We will confirm deletion in writing upon request.

8. Your Rights

Depending on your location and the data protection laws applicable to your personal data, you may have some or all of the following rights. We will respond to any request to exercise your rights within thirty (30) days of receipt and will not charge a fee for doing so in ordinary circumstances.

Right of access — you have the right to request a copy of the personal data we hold about you and information about how we use it, where it came from, who we share it with, and how long we retain it.

Right to rectification — you have the right to request that we correct any inaccurate or incomplete personal data we hold about you. We encourage you to let us know if any information we hold is out of date or incorrect.

Right to erasure — you have the right to request that we delete your personal data in certain circumstances, including where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you have successfully objected to processing.

Right to restriction — you have the right to request that we restrict our processing of your personal data in certain circumstances, for example while we consider a correction or objection request.

Right to data portability — where processing is based on your consent or the performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another controller where technically feasible.

Right to object — you have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. Upon receiving your objection we will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

Right to withdraw consent — where we rely on your consent as the lawful basis for any processing, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to withdrawal.

Right not to be subject to automated decision-making — we do not make decisions about you solely by automated means that produce legal or similarly significant effects. All candidate assessments and decisions involve human review.

Right to lodge a complaint — you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction if you believe we have not handled your personal data in accordance with applicable law:

• In Singapore: Personal Data Protection Commission (PDPC) — www.pdpc.gov.sg

• In the European Union: the data protection authority in your country of residence or establishment

• In the United Kingdom: the Information Commissioner's Office (ICO) — www.ico.org.uk

We would appreciate the opportunity to address any concerns directly before you contact a supervisory authority and encourage you to reach out to us in the first instance.

9. Cookies and Online Tracking

Our website uses only strictly necessary cookies that are essential for the website to function correctly and securely. We do not use analytics, marketing, or tracking cookies and no consent is required for strictly necessary cookies. For further information please refer to the Cookies and Online Tracking section of our Data Protection and Privacy Policy, available at www.rhumblgroup.com/privacy or contact our Data Protection Officer at dpo@rhumblgroup.com.

10. How to Contact Us

If you have any questions about this notice, wish to exercise any of your rights, have a concern about how we handle your personal data, or wish to opt out of future contact from us, please contact us at:

Rhumbl Group Pte. Ltd. 160 Robinson Road, #14-04 SBF Center, S068914 Email: dpo@rhumblgroup.com Website: www.rhumblgroup.com

We are committed to handling all data protection enquiries promptly, professionally, and in accordance with our legal obligations. We will acknowledge your request promptly and respond in full within thirty (30) days of receipt.

11. Changes to This Notice

We may update this notice from time to time to reflect changes in our data processing practices, technology, legal requirements, or other factors. Where we make material changes we will notify active candidates by email where we hold your contact details. We will update the date at the top of this notice each time it is revised. We encourage you to review this notice periodically to stay informed about how we protect your personal data.