Effective Date: August 26, 2024

Controller of Personal Data
Any personal data processed by Sirius XM Ireland Limited (“Sirius XM Ireland”, “we” or “us”) (or its third-party recruitment partners and service providers) in connection with this Applicant Privacy Notice (the “Notice”) is controlled by Sirius XM Ireland Limited as the “data controller” under the General Data Protection Regulation (EU 2016/679) (“GDPR”) and any amending or replacement legislation. Our address is 124/127 St. Stephens Green, Ground Floor, Dublin, Dublin D02 C628, Ireland. See “Contact Us” below.

Sirius XM Ireland provides this Notice to explain our data practices for the information we collect from you as a job applicant. We will process your personal data as described in this Notice and will be responsible for complying with applicable data protection laws. Note that if you are later employed by Sirius XM Ireland, your employment information will be governed by a separate personnel privacy notice.

Scope of the Notice
The Notice is designed to cover the personal data that we collect, use, and disclose in connection with processing your application for employment with us. When we refer to “personal data,” we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or is otherwise defined or regulated as personal data under applicable laws or regulations. This includes information that directly identifies you (such as your name, Personal Public Service Number, passport number, driving license, Irish Residency Permit, Temporary Residence Certificate, or other official identifier), but also includes information which we may have linked to those identifiers (such as your date of birth, telephone number, or employment history, all of which we may have linked to your name).

Please note that we utilize a careers portal that is operated by iCIMS, a third party, who acts as our data processor. Your use of the careers portal will be subject to the third party’s terms of use and privacy practices as disclosed on the portal.

Personal Data We Collect
When you apply for a job with Sirius XM Ireland, we will ask you to provide us with personal data about yourself so we can evaluate your application. We may ask for additional personal data if we extend you a conditional offer of employment. If you do not provide us with this information, our ability to consider you as a candidate may be limited. You may also provide us with your personal data that we have not specifically requested, for example your resume may include information about your hobbies or social preferences. You are solely responsible for determining the extent of information that you provide to us, and all information you provide is done so voluntarily and/or with your consent.

Personal data we collect from you may include:

• Basic personal details (for example, your name)

• Contact details (for example, your telephone number, email address or mailing address)

• Employment details (for example, your employment background including current or previous employers, job titles, work experience, or salary)

• Professional details (for example, preferred work location(s), willingness to relocate, immigration status)

• Whether you are 18 years of age or older

• Education information (for example your level of schooling, degrees, certificates, or transcripts)

• Background information, where relevant to your application and permitted under applicable law (for example, employment verification or criminal background screenings, which we will only request if we extend you a conditional offer of employment and only when applicable and permitted by law). For New York residents only: information related to a background check is collected after the initial screening round has been completed.

• Information related to previous applications with Sirius XM Ireland, whether you have relatives currently employed by Sirius XM Ireland, or previous employment history with Sirius XM Ireland.

• Financial information, where relevant to your application and permitted under applicable law (for example salary, tax information, benefits or company allowances)

• Login information when you create a profile with us for submitting applications for employment

• How you heard about the job opportunity for which you are applying

• Any other information in your application that you elect to share with us (for example your hobbies or other interests)

• Information you provide to us regarding a disability if you request accommodation in relationship to the application process

Note that the personal data identified above is necessary for our recruiting activities. Failure to provide or allow us to process your personal data may affect our ability to accomplish the purposes stated in this Notice such as review your application.

Information Collected Automatically
We, our service providers, and/or other third parties may automatically collect and/or store certain information when you visit or interact with our employment application portal or otherwise online as a job applicant (“Usage Information”). This Usage Information may be stored and/or accessed from your computer, tablet, mobile phone, or other device whenever you visit or interact with the employment application portal. Usage Information may include, but is not limited to:

• Your IP address, mobile device identifier and other unique identifiers

• Device information, including device model, operating system version, device date and time, mobile network information

• Geolocation of your device

• How you use and interact with the employment application portal, including pages you visit within the portal, content you view, and your preferences

• The URL or job advertisement that referred you to our employment application portal

Usage Information may be collected through the use of the following technologies:

• Cookies and Local Storage. Cookies and local storage are data files placed within a browser on a device when it is used to visit the employment application portal. Certain web browsers and browser add-ons may provide additional local data storage mechanisms. Cookies and local storage can be used for a variety of purposes, including to store a unique identifier for your device that recognizes your device as you visit the employment application portal or other websites or online services, and to remember your preferences. Additionally, most browsers provide you with the ability to disable, decline, or clear cookies and local storage; please check your browser’s settings for further information. However, if you disable cookies you may find this affects your ability to use certain parts of the employment application portal. For more information about cookies, please visit https://www.aboutcookies.org.

• Web Tags. Small graphic images or other web programming code (also known as 1x1 GIFs or clear GIFs) may be included in our web pages and email messages. These and similar technologies may be used for a number of purposes, including to count visitors to the application portal, or to monitor how users navigate the application portal. The information we collect through this technology may include the first date and time you open our email, and whether you click any links included in our email.

Information from Third Party Careers Portals and Other Third Parties
We may receive information about you from third party careers portals, for example when you apply to one of our job postings through that portal. The information we receive is subject to this Notice. The information collected and stored by the third party careers portal remains subject to its privacy notice.

We may also receive information about you from other third parties, such as third-party background checking companies, sources of publicly available information, and individuals or entities whose information you provide to us for employment verification.

How We Use Your Personal Data
We process personal data in various ways depending on the nature and progress of your application and the services we provide you in connection with your application. We process your personal data where applicable law permits or requires it in connection with carrying out our application and recruitment process with you, to take steps as necessary to enter into an employment contract with you, if applicable; compliance with our legal obligations that apply to us as; with your consent; or as necessary for our legitimate interests or the legitimate interests of third parties in connection with your application, where those interests do not override your fundamental rights and freedoms related to data privacy. We may process your personal data based on the lawful basis/bases outlined below:

You will not be subject to hiring decisions based solely on automated data processing without your prior consent.

We will only process your personal data for the purposes we collected it for or for compatible purposes. If we need to process your personal data for an incompatible purpose, we will provide notice to you and, if required by law, seek your consent. We may process your personal data without your knowledge or consent where required by applicable law or regulation.

How We Share Your Personal Data

We will not disclose or otherwise distribute to any third party any of your personal data without your prior permission, except under the following circumstances:

• At your direction: We may disclose your personal data when you direct us to do so.

• Sirius XM Ireland Parent, Subsidiaries, and Affiliates: Sirius XM Ireland is part of an international group of affiliates and subsidiaries, and certain services or business functions may be centralized by its parent company, Sirius XM Radio Inc. or one or more affiliates for the whole or part of the Sirius XM Ireland group. As such, we may share your personal data with our parent or affiliates for business, analytical, and operational purposes.

• Third-party service providers: We may outsource some or all of the operations of our business to third-party service providers and we may use third parties to act as our agents to provide services to us or to you. Services provided by third parties may include background checking, accounting, legal, recruiting, and other professional services. In such cases, it will be necessary for us to disclose your data to those service providers. In some cases, the third parties may collect data directly from you on our behalf. We restrict how such third parties may access, use and disclose your data.

• Legal requests and investigations and to comply with law: We may be required to disclose certain information about you to comply with government reporting requirements, laws, or regulations. We may disclose any data about you when, in our opinion, such disclosure is necessary to prevent fraud or to comply with any statute, law, rule or regulation of or any legal process issued by any governmental authority or any order of any court of competent jurisdiction. We may also disclose data about you when necessary for us to exercise and defend legal claims and enforce our rights.

• Business Transfers: As we continue to develop our business, we might sell or buy companies, subsidiaries, or business units. In such transactions, employee data, including data relating to prospective employment and recruiting, is typically one of the transferred business assets. Any data transferred will, to the extent required by law, remain subject to the promises made in any pre-existing privacy statement unless you consent to the new privacy notice, which may be required as a condition of employment or of continuing the recruitment process, subject to applicable law in your jurisdiction.

Security of Your Personal Data
We have adopted commercially reasonable security procedures and practices designed to protect your personal data in our possession from loss, misuse and unauthorized access, disclosure, alteration, and destruction, including physical, technical and administrative controls. However no data transmission over the Internet, wireless transmission, or electronic storage of information can be guaranteed to be 100% secure. Sirius XM Ireland cannot ensure or warrant the security of any information we collect. You provide us your information at your own risk.

Retention of Your Personal Data
The length of time we retain your personal data depends on the status of our relationship with you and applicable legal requirements. We will retain your personal data for as long as your prospective employment (and, if applicable, employment) with us lasts, and for a certain period after your employment or recruitment process with us has ended. To determine that period, we take into account our legal and regulatory obligations (such as financial reporting obligations and equal opportunity or anti-discrimination reporting obligations) and whether we may need to retain personal data to resolve disputes, make and defend legal claims, conduct audits, pursue legitimate business purposes and/or enforce our agreements.

Do Not Track
Please note that your browser settings may allow you to automatically transmit a “Do Not Track” signal to websites and online services that you visit. When you choose to turn on the “Do Not Track” setting in your browser, your browser will send a signal to websites, analytics providers, advertisement networks, plug-in providers, and other web service providers you encounter while browsing to stop tracking your activity. To find out more about and set up “Do Not Track,” please visit http://www.allaboutdnt.com.

Global Privacy Control
Global Privacy Control (“GPC”) is a technical specification in your browser settings that you can use to automatically inform websites of your privacy preferences with regard to third party online tracking. To find out more about and set up GPC, please visit https://globalprivacycontrol.org/#about.

Cross-Border Data Transfers
Where permitted by applicable law, we may transfer the personal data we collect about you to the United States and other jurisdictions that may not be deemed to provide the same level of data protection as your home country for the purposes set out in this Notice. If you are located in the EU or the United Kingdom, we have implemented standard contractual clauses to secure the transfer of your personal data to the United States and other jurisdictions.

Data Subject Rights
You have the following rights pursuant to the GDPR and other applicable laws:

• Withdraw consent: If we have collected personal data with your consent, you have the right to withdraw that consent at any time.

• Access: You have the right to request access to personal data we collected about you and information about its sources, purposes, and sharing.

• Correction: You have the right to request that we correct the personal data we hold about you if it is inaccurate or incomplete.

• Erasure: You have the right to request that we erase data we have collected from you. Please note that we may have a reason to deny your deletion request or delete data in a more limited way than you anticipated, e.g., because of a legal obligation or right to retain it.

• Portability: You have the right, in certain circumstances, to request that we provide your personal data to you in a format that can be transferred to another entity.

• Restrict Processing: You have the right, in certain circumstances, to request that we limit our processing of your personal data if you are (1) contesting the accuracy of your personal data, (2) asserting that our processing is unlawful; (3) asserting that we no longer need to keep the information for reasons related to the establishment, exercise, or defense of legal claims, or you object to our processing.

• Object: You have the right to object to our processing if we are processing your personal data based on legitimate interests, using your personal data for direct marketing (including profiling), or processing your personal data for purposes of scientific or historical research and statistics.

To make a request or to exercise any of the rights detailed below, please go to the dashboard of your Sirius XM Ireland profile and click on “Data Subject Requests” you can contact us at talentacquisition@siriusxm.com. If you are unsatisfied with our response to any issues that you raise, you may have the right to make a complaint with the data protection authority in your jurisdiction by contacting the data protection authority.

We must verify your identity for everyone’s protection, so we may require you to provide us with verification information prior to accessing any records containing personal data about you. We do this by asking you to provide personal identifiers we can match against information we may have collected from you previously and confirm your request using the email or telephone account stated in the request;

We will use the information you provide for verification only for the purpose of verification. We may have a reason under the law why we do not have to respond to your request or respond to it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

Changes to this Notice
To the extent allowed by applicable law, we reserve the right to change this Notice at any time without prior notice. If we make material changes to our Notice, we will update the effective date and post a notice to our online website and applicant portals where this Notice is displayed. We may also provide notice to you in other ways, such as through contact information you have provided, and provide you with the ability to opt-in or opt-out of the changes as required by law.

Contact Us
If you have any questions about our processing of your personal data or would like to make an access or other request, please contact us at: talentacquisition@siriusxm.com or at the address listed above, Attn: Privacy Officer.