Candidate Privacy Notice

This notice explains how Medserv Ireland Ltd ("we", "us", or "the Company") collects and processes your personal data when you apply for a role with us, and the purposes for which it is used. This notice has been prepared in accordance with the EU General Data Protection Regulation (GDPR) (2016/679), the Data Protection Acts 1988-2018, and the Data Protection Act 2018 (as amended). Where our processing is based on your consent, you may withdraw it at any time by contacting us at: hr@medserv.ie

1. Data Controller

The data controller responsible for your personal data is: Medserv Ireland Ltd

Email: gdpr@medserv.ie

2. Personal Data We Collect

We collect and process the following categories of personal data during recruitment:

Data we are required to collect

• Identification data (name, date of birth)
• Contact details (address, email, phone number)
• Education history and qualifications
• Professional experience and employment history
• Skills and competencies

Data processed on the basis of legitimate interest

• Expected salary and availability to start work
• Information relating to recruitment meetings and scheduling
• Our assessment of your suitability for the role
• Email address used for system identification (BambooHR)
• Publicly available professional information (e.g. LinkedIn profile)
• Results of competency assessments
• Data obtained in connection with recruitment agency cooperation

Data processed on the basis of your consent

• Any voluntary information included in your application (e.g. photograph, interests)
• References or testimonials from former employers
• Any sensitive personal data you choose to include (see Section 7)

3. AI-Assisted Screening

Important Notice: As part of our recruitment process, we use an AI-assisted screening tool to support the initial review of candidate applications. This section explains how it works and your rights in relation to it.

How the AI screening tool works

Our tool processes your CV and application data submitted via BambooHR to produce a structured preliminary assessment. The tool assigns one of three preliminary labels:

• Recommended - the application appears to meet the role's core requirements
• Consider further - the application may partially meet the requirements or needs closer review
• Not shortlisted - the application does not appear to meet the role's core requirements

A summary of the assessment is shared with the relevant hiring manager to inform - not replace - their decision-making. All shortlisting decisions are made by a human reviewer.

Legal basis for automated processing

This automated processing is carried out on the basis of our legitimate interest in operating an efficient, consistent, and fair recruitment process (Article 6(1)(f) GDPR). As an additional safeguard, AI-assisted screening is only carried out where you have given your consent (see below). We have conducted a Legitimate Interests Assessment (LIA) to balance these interests against your rights. This LIA was conducted in consultation with our external Data protection partners XpertDPO.

Human oversight - no solely automated decisions

In accordance with Article 22 GDPR and the EU AI Act, no recruitment decision is made solely on the basis of automated processing. All decisions are made by a human reviewer with full visibility of your original application.

EU AI Act compliance

Our AI-assisted screening tool is classified as a "high-risk" AI system under Annex III of the EU AI Act (2024/1689), which applies to AI used in employment and recruitment contexts. In accordance with our obligations, we:

• Maintain human oversight of all AI-generated outputs
• Log AI assessments for audit and accountability purposes
• Conduct ongoing monitoring of the tool's accuracy and potential for bias
• Do not use the AI tool as the sole basis for any recruitment decision
• Make this notice available to all candidates prior to or at the point of application

Your consent to AI-assisted screening

We use an AI-assisted tool to support the initial screening of applications. Your application will only be processed by this tool if you give your consent to do so. The application form includes a consent question asking whether you agree to AI-assisted screening. Before any application is processed, the system checks your answer:

If you consent, your application may be screened with the support of our AI-assisted tool, with final decisions always made by a human reviewer. If you do not consent - or if your consent cannot be confirmed - your application will not be sent to the AI tool under any circumstances. Instead, it will be reviewed through our standard manual process by a human reviewer only. Choosing not to consent will not disadvantage your application in any way. Applications reviewed manually are given the same consideration as those screened with AI assistance.

If you wish to change your consent decision after submitting your application, please contact us at hr@medserv.ie as soon as possible.

You have the right to:

• Be informed that automated processing is taking place (which this notice fulfils)
• Decline consent to AI-assisted screening - your application will be reviewed manually, with no disadvantage to you (see above)
• Withdraw your consent at any time after submission - if AI processing has not yet taken place, your application will be reviewed manually
• Request human review of any AI-assisted assessment applied to your application
• Express your point of view and contest the outcome of any automated assessment

To exercise any of these rights, please contact: hr@medserv.ie

4. Purposes and Legal Bases for Processing

We process your personal data for the following purposes:

• Recruitment for the advertised role: Legal basis - compliance with employment law and legitimate interest.
• Pre-contractual actions: Legal basis - Article 6(1)(b) GDPR (steps taken at your request prior to entering a contract).
• AI-assisted screening: Legal basis - Article 6(1)(f) GDPR (legitimate interest), subject to human oversight.
• Future recruitment (with consent): Legal basis - Article 6(1)(a) GDPR (your explicit consent).
• Recruitment satisfaction surveys: Legal basis - Article 6(1)(f) GDPR (legitimate interest).
• Establishing, pursuing, or defending legal claims: Legal basis - Article 6(1)(f) GDPR (legitimate interest).
• Repeat recruitment (if required): Legal basis - Article 6(1)(f) GDPR (legitimate interest).

5. Data Retention

We retain your personal data for the following periods:

• Application for the advertised role (CV and application data): 12 months from application submission
• Future recruitment (only where you have consented): 24 months from the date of consent
• AI-generated screening reports and assessments: 12 months from creation, for audit and accountability purposes
• AI screening logs: 12 months (substantive audit records); short-term operational system logs are held for 30 days and contain no candidate data
• Records relating to legal claims: 12 months from conclusion of the recruitment process
• Where applicable, recruitment satisfaction surveys: 12 months
• Temporary files created during AI processing (for example, document conversion files) are deleted immediately after your application is processed. CVs submitted to the AI tool for screening are deleted at the end of each screening run. Retention limits are enforced automatically: records that exceed their retention period are deleted by scheduled processes and deletions are logged for audit purposes.

After these periods, your data will be securely deleted or anonymised unless we are required by law to retain it for longer. Retention periods are set in accordance with the GDPR and the Data Protection Acts 1988-2018.

6. Data Sharing and Transfers

We may share your personal data with:

• Job advertisement service providers
• Recruitment management system providers (including BambooHR)
• AI tool and technology providers (including API-based AI services)
• IT and hosting service providers
• XpertDPO and other HR advisory or compliance service providers

Some recipients may be located outside the European Economic Area (EEA), including in the United Kingdom. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as European Commission adequacy decisions (including for the United Kingdom), Standard Contractual Clauses (SCCs) as adopted by the European Commission, or certification under the EU-US Data Privacy Framework. You may request a copy of the safeguards we apply to international transfers by contacting: hr@medserv.ie

7. Sensitive Personal Data

We do not require sensitive personal data (special category data as defined under Article 9 GDPR - including data relating to health, ethnicity, religion, sexual orientation, or disability) as part of your application, and we ask that you do not include it unless you consider it strictly necessary (for example, to request a reasonable accommodation). Any sensitive data you choose to include is not used in assessing your application, and our AI screening tool is not designed to consider such information.

8. Your Rights

Under the GDPR and the Data Protection Acts 1988-2018, you have the following rights:

• Right of access - to obtain a copy of your personal data
• Right to rectification - to correct inaccurate or incomplete data
• Right to erasure - to request deletion of your data in certain circumstances
• Right to restriction - to limit how we process your data
• Right to data portability - to receive data you provided in a structured, machine-readable format, where processing is based on consent or contract
• Right to object - to object to processing based on legitimate interest, including AI-assisted screening
• Right not to be subject to solely automated decisions - to request human review of any AI assessment
• Right to withdraw consent - at any time, without affecting the lawfulness of prior processing
• Right to lodge a complaint - with the Data Protection Commission (www.dataprotection.ie)

To exercise any of your rights, please contact: gdpr@medserv.ie

9. Review of This Notice

We are committed to keeping this Privacy Notice accurate, current and compliant with applicable legislation. We will review this notice:

• At least annually
• Following any material change to our recruitment practices or the AI screening tool
• In response to changes in applicable legislation or regulatory guidance

All of which will be exercised in consultation with our external Data protection partners, XpertDPO.

10. Additional Changes

We may update this notice from time to time. Where changes are material and your data is still held by us, we will take reasonable steps to inform you. Questions or consent requests: gdpr@medserv.ie (cc hr@medserv.ie)

11. Version Control

This notice is Version 1.0, published July 2026. It reflects consent-based AI screening, defined retention periods, international transfer safeguards and sensitive data handling.