Job applicants

Introduction

This notice explains how Saab AB and its Swedish subsidiaries ("we", "us", or "Saab") collect, use, share, and retain your personal data in connection with our recruitment activities. It applies to you whether you have applied for a role directly, or whether we have contacted you as part of our outreach recruitment.

Please note that Combitech AB — a subsidiary of Saab AB — conducts its own recruitment separately and maintains its own privacy notice for job applicants, available on the Combitech website. However, because both Saab AB and Combitech AB use the same recruitment platform (Workday), your candidate account is shared across both companies. Please read the "Shared candidate account" section carefully, as this has important implications for how your personal data is managed and how you exercise your rights.

If you are asked to consent to being included in our Talent Community, please also read the "Talent Community" section below, which explains what that means and what your rights are.

Who is responsible for your personal data?

Saab AB and its Swedish subsidiaries are the data controllers responsible for your personal data as described in this notice.

Saab AB (publ), 581 88 Linköping, Sweden, telephone number +46 13-18 00 00, or the Saab subsidiary that you have interacted with, is the controller of your personal data. You can find contact information for the relevant Saab company under Locations.

If you have any questions about this notice or wish to exercise any of your rights, please contact our Group Data Protection Officer (DPO): dpo@saabgroup.com

What personal data will be processed?

Data you provide to us directly

When you apply for a position with us, we may collect and process the following categories of personal data:

• Full name, address, e-mail address, and telephone number
• Personal identity number (personnummer) where relevant and permitted by applicable law
• CV, covering letter, and other application documents
• Details of your qualifications, skills, experience, and employment history
• References provided by you or obtained with your knowledge
• Results of any tests, assessments, or interviews
• Documentation relating to your right to work in Sweden
• Information provided through your candidate account in Workday, our recruitment management system

We collect this data directly from you through your application submitted via Workday, through interviews and assessments, and through any digital platforms through which you apply.

Data we collect from third parties

We may also receive personal data about you from the following third-party sources:

• Recruitment agencies, where you have been put forward for a role through an agency
• Referees, when we carry out reference checks
• Test providers, when you are asked to complete a test or assessment

If Saab asks you to provide additional information in connection with a security assessment, you can find more information here: Information for self-declaration and security vetting at Saab

Data collected in connection with outreach recruitment

Where we proactively contact you about a position — rather than you having applied directly — we identify potential candidates through publicly available sources. These include professional networking platforms such as LinkedIn, and open professional directories or databases operating under a Swedish publishing certificate (utgivningsbevis).

At this initial stage, before any further dialogue has taken place, we process only the basic personal data necessary to make first contact with you — typically your name, contact details, and current professional role or headline.

If you indicate that you are not interested, we will not continue to contact you.

If you express an interest in learning more, we will invite you to apply for a relevant position. It is only at that point — when you actively submit an application — that more detailed personal data will be recorded in our systems. For information about what is processed once you have submitted an application, see the "Data you provide to us directly" section. For information about what is processed if you consent to joining our Talent Community, see the "Talent Community" section.

For what purposes do we process your personal data, and on what legal basis?

We process your personal data only where we have a lawful reason to do so. The table below sets out our purposes and the legal basis we rely on for each.

More detail on our legitimate interests

Where we rely on legitimate interest as our legal basis, we have carried out a balancing assessment to weigh our interests against yours. Here is a summary:

Recruitment and selection: We have a legitimate interest in identifying and selecting suitable candidates for our vacancies. The processing is limited to what is necessary for the recruitment process and is expected by anyone who chooses to apply for a role. We consider that this interest is proportionate and does not override the rights and interests of applicants.

Reference checks and skills assessments: We have a legitimate interest in verifying the information provided by candidates and in assessing whether candidates have the skills required for the role.

Candidate experience survey: We send a short, optional survey via Trustcruit following the conclusion of the recruitment process. We have a legitimate interest in evaluating and improving our recruitment practices. Participation is entirely voluntary.

Outreach recruitment: We have a legitimate interest in proactively identifying and contacting people who may be suitable for current or future vacancies at Saab. When carrying out outreach recruitment, we only use information that is already publicly available, and we limit the data we process to what is necessary for this purpose. This legal basis applies only for the initial period of contact — that is, from the point at which we first identify and reach out to you until you have had the opportunity to decide whether you wish to join our Talent Community. If you consent to joining the Talent Community, the processing of your personal data from that point onwards is based on your consent rather than our legitimate interest. You are always free to decline further contact at any time.

You have the right to object to processing based on legitimate interest. Please see the "Your Rights" section for details.

Talent Community

If you choose to give your consent, we will retain your personal data in our Talent Community so that we can continue our recruitment dialogue with you and contact you about future job opportunities that may match your profile.

What data will be retained?

If you consent to joining our Talent Community, we will retain the following personal data about you:

• Your name and contact details
• Your CV and application documents (where provided)
• Information about your qualifications, skills, and experience
• The source through which you were identified or came into contact with Saab
• Notes and assessments made during any recruitment or outreach process

Purpose and legal basis

Your data will be used to continue our recruitment dialogue with you and to identify and contact you regarding future employment opportunities at Saab that may match your profile. The legal basis for this processing is your consent in accordance with Article 6(1)(a) of the GDPR.

How long will your data be retained?

Your personal data will be retained in the Talent Community for 36 months from the date on which you provide your consent. After this period of time, your data will be deleted.

How do you consent, and how can you withdraw?

You may give your consent by ticking the relevant box at the point of submitting your application. Where you have been contacted by Saab through outreach recruitment, you will be given the opportunity to consent once you have been invited to apply for a position. Your consent is entirely voluntary. Choosing not to consent, or later withdrawing your consent, will have no impact on the assessment of any current or future application you submit to Saab, nor on any ongoing dialogue between you and Saab.

Please however note — as explained in the "Shared candidate account" section below — that because Saab AB and Combitech AB share a single candidate account in Workday, withdrawal of your Talent Community consent will affect your profile with both companies simultaneously.

You may withdraw your consent at any time by contacting our Group DPO at dpo@saabgroup.com or by completing the withdrawal form available at saab.com. Withdrawal does not affect the lawfulness of any processing carried out before your withdrawal.

Shared candidate account — important information for applicants to both Saab and Combitech

Because both Saab AB and Combitech AB use the same recruitment platform (Workday), your candidate account and all personal data held within it is shared across both companies. This means that if either Saab AB or Combitech AB deletes your candidate account — whether in response to a request from you or because the applicable retention period has expired — this will affect your candidate profile for both companies simultaneously.

This also affects how we respond to requests for a copy of your personal data (right of access). Because it is not technically possible to separate Saab AB's and Combitech AB's recruitment data when exporting records from Workday, any report provided in response to an access request relating to recruitment data will contain personal data held by both companies within the shared candidate account. You should be aware of this when submitting an access request relating to your recruitment data.

If you have applied, or intend to apply, to both Saab AB and Combitech AB, you should be aware of the above before exercising any of your data subject rights, as doing so may affect your candidacy with both companies at the same time. If you have any questions about how this affects you, please contact our Group DPO at dpo@saabgroup.com before submitting your request.

Who do we share your personal data with?

We share your personal data only where necessary and only with parties who are required to handle it in accordance with applicable data protection law.

Within Saab: Access to your personal data is restricted to those persons who need it for the purposes described in this notice. This typically includes members of the recruitment panel, HR personnel, and relevant internal decision-makers. Please note that, as a result of the shared Workday candidate account described in the "Shared candidate account" section, authorised personnel at Combitech AB may also be able to view candidate account data held on the shared platform.

Our data processors: We transfer personal data to third-party service providers, who act as data processors on our behalf and process your data only in accordance with our instructions and applicable law.

• Workday — our recruitment management system
• Test & Assessment tools as a part of the recruitment process
• Trustcruit — a third-party survey platform used to send you a short, optional candidate experience survey following the conclusion of the recruitment process
• Recruitment agencies: Where you have been put forward for a role by a recruitment agency, we may share relevant information with that agency in connection with your application.

We do not sell your personal data to third parties.

International transfers of personal data

Some of the service providers we use may process your personal data outside the European Economic Area (EEA). Where this is the case, we ensure that appropriate safeguards are in place to protect your data, such as standard contractual clauses approved by the European Commission. You can obtain further information about these safeguards by contacting our Group DPO using the contact details in the "Who is responsible for your personal data?" section.

How long do we retain your personal data?

Please note that because Saab AB and Combitech AB share a single candidate account in Workday, the retention period applied by one entity will affect the candidate profile held by both entities. See the "Shared candidate account" section for further details.

Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Access the personal data Saab holds about you — please note that access requests relating to recruitment data will include data from the shared Workday account (see the "Shared candidate account" section)
• Rectify any inaccurate or incomplete personal data
• Request erasure of your personal data in certain circumstances
• Restrict the processing of your personal data in certain circumstances
• Object to processing based on legitimate interest
• Data portability — receive your data in a portable format where processing is based on consent or contract
• Withdraw your consent at any time, without any negative consequences, by e-mailing dpo@saabgroup.com or by completing the withdrawal form at saab.com. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.
• Lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at www.imy.se or +46 8 657 61 00

To exercise any of the above rights, please contact our Group DPO at dpo@saabgroup.com. We will respond within one month. Please be aware that where your request relates to recruitment data held in the shared Workday platform, certain actions — including erasure and access requests — may have consequences for, or include data from, your candidate profile with both Saab AB and Combitech AB. Please refer to the "Shared candidate account" section above before submitting your request.

Changes to this notice

We may update this privacy notice from time to time to reflect changes in our practices or applicable law. The date at the top of this notice indicates when it was last updated. We encourage you to review this notice periodically.