1. Personal data we use

2. How we use your personal data and the basis on which we use it

3. Your rights over your personal data

4. Automated decisions about you

5. Data sharing

6. Data security and storage

7. International data transfer

8. Contact us and changes to the Privacy Statement

At Glooko, we are committed to protecting your personal data, as well as achieving and maintaining your Trust in how we collect, process and handle that data. Protecting your privacy is very important to us, and central to the entire Glooko family.

This privacy statement describes the handling of personal data obtained about internal and external job applicants, including referral and applicants who have applied directly through the Glooko online recruitment system and careers page (the “recruitment system”) as well as through third party agencies and recruiters on behalf of candidates. It also describes the handling of personal data of any prospective candidates or leads, such as those individuals who expressed an interest in receiving news and details about future Glooko opportunities or other related communications. Personal data is information, or a combination of pieces of information, that could reasonably allow you to be identified.

This privacy statement describes how Glooko, Inc. and its local affiliate relevant to the job in question (“we”, “us”, or “Glooko”) collect and process personal data about you, how we use and protect this information, and the rights that may be available to you under applicable law in relation to this information.

1. PERSONAL DATA WE USE

We will collect your personal data from you directly and potentially from other sources.

1.1 Data we collect directly from you

The categories of data that we collect directly from you include:

1. Identifiers:
   1. personal (e.g. name) and contact details (e.g. phone number, email address, postal address or mobile number).
   2. username and password for the online recruitment system.
   3. information about family and dependents (e.g. for relocation purposes).
2. Professional and Employment-Related Information:
   1. information contained in your resume or CV, and other documents related to the application or recruitment process (e.g. cover letter, transcripts, certifications).
   2. other information you may choose to voluntarily submit to us in connection with your application (e.g. information contained in a cover letter, information disclosed in an interview or information you volunteer regarding your criminal records history, compensation history, family history or personal situation).
   3. debarment, suspension or related information as it relates to an award for a contract from a US federal agency or relevant licenses).
3. Educational Information:
   1. educational details (e.g. educational history, qualifications, certifications, skills) and job history (e.g. previous employment, roles, performance history).
4. Personal Characteristics:
   1. data for diversity monitoring, where the collection of such data is allowed by law (e.g. race, ethnicity, gender, veteran status and/or disabilities).
   2. citizenship or immigration information (e.g. for visa purposes, right to work information).
5. Health Information:
   1. information about any health issues or disabilities (e.g. your disability status, any requests for accommodation in the application or interview process).
   2. information about your health status, where appropriate (e.g. confirmation of your wellness prior to attending an in person interview).
6. Electronic, Visual and Audio Information
   1. on-premise location monitoring for security purposes (e.g. video surveillance when attending our premises for an interview).
7. Internet Activity Information:
   1. information about you using cookies and similar technologies when you use the recruitment system and browse our website

1.2 Data we collect from other sources:

We may collect the following data about you from other sources:

1. Professional and Employment-Related Information:
   1. background check data, potentially including your criminal records history, employment history, educational history and/or compensation history, from employment screening agencies, publicly available registers or databases, former employers and/or educational institutions (as allowed by local laws).
   2. information about your performance or conduct from references, other Glooko employees, clients or service providers, or former employers you work with and/or with whom you may have worked in the past who may provide feedback about you.
   3. information about you from Glooko employees who interview you and who may provide feedback about you.
2. Internet Activity Information:
   1. publicly available information from websites or social media, including information that you choose to voluntarily submit to us in connection with your application (e.g. when applying through LinkedIn).

2. HOW WE USE YOUR PERSONAL DATA AND THE BASIS ON WHICH WE USE IT

We limit our use of your personal data. We aim to only collect and use your personal data for specific, necessary reasons and aim to explain our use of your personal data. For example, we use your personal data to:

1. create and manage the recruitment system, job applications and a database of interested individuals and lead
2. assess and evaluate your skills, qualifications and interests against the position applied for and/or other positions within the Glooko group of companies
3. communicate with you in relation to your expressed interest in Glooko, job opportunities/ leads, application or the recruitment process
4. verify your information, including through reference checks and, where applicable, background check
5. send you information about the new hire and employee experience at Glooko prior to your first day
6. with your consent, send you information about positions within the Glooko group of companies which may be of interest to you
7. operate, evaluate and improve the recruitment system, our application tracking and recruitment activities (this includes analyzing our job applicant base, our hiring practices or trends, identifying qualifications or skills shortages, and using information to match candidates and potential opportunities
8. detect, prevent and respond to fraud or potentially illegal activities (such as intellectual property infringement), misuse of the recruitment system or other applicable policies
9. perform audits, assessments, maintenance and testing or troubleshooting activities related to the recruitment system and our recruitment processes
10. comply with legal obligations to which we are subject and cooperate with regulators and law enforcement bodies
11. respond to your enquiries and request

We must have a legal basis to process your personal data. In most cases the legal basis will be one or more of the
following:

1. to comply with our contractual obligations to you or to take steps to enter into a contract with you
2. to comply with our legal obligations
3. with your consent
4. to meet our legitimate interests, for example to conduct our recruitment processes efficiently and fairly or to manage applicants effectively. When we process personal data to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy or other fundamentals rights and freedoms are not overridden by our legitimate interest to comply with our legal obligations, for example obtaining proof of your right to work status to enable us to meet relevant obligations.

When we are required by local law to collect certain personal data about you, your failure to provide this data may prevent or delay the fulfillment of our legal obligations and may impact our ability to employ you. If we ask for your consent to process your personal data, you may withdraw your consent at any time by contacting us using the details at the end of this privacy statement.

3. YOUR RIGHTS OVER YOUR PERSONAL DATA

You have certain rights regarding your personal data, subject to applicable local laws. These include the following rights to:

• access your personal data.
• fix any errors in your personal data.
• erase or delete your personal data.
• restrict our use of your personal data.
• object to our use of your personal data.
• receive your personal data in a usable electronic format and transmit it to a third party (right to data portability).
• lodge a complaint with your local data protection authority or regulatory body.

If you would like to exercise any such right, please contact us at [email protected].

We encourage you to contact us to update or correct your information if it changes or if the personal data we hold
about you is inaccurate.

4 . DATA SHARING

While we do not sell or market your personal data, we may share your personal data with third parties in limited situations, including with:

• Glooko group companies. We may share your personal data with other companies that fall within the Glooko group, for example for recruitment purposes, human resource management and internal reporting.
• Service providers and business partners. We may share your personal data with our service providers and business partners that perform business operations for us. For example, we may partner with other companies to host the recruitment system and analyze data to improve performance or engage third parties to audit our systems, products or practices.
• Law enforcement agency, court, regulator, tax authority, government authority or other third party. We may share your personal data with these parties if necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights, your rights or the rights of any third party.

5 . DATA SECURITY

Security is an integral part of our business model and we put significant resources into making sure your data is protected. This involves technical measures (such as implementing security software) and organizational measures (such as only allowing staff to access your data if there is a business need to do so). These measures are aimed at ensuring the on-going integrity and  confidentiality of personal data. We evaluate these measures on a regular basis to ensure the security of the processing.

We will keep your personal data until the position you are applying for has been filled, after which we will retain your personal data for a period of time that enables us to:

• Maintain business records for analysis, understanding market trends and/or audit purposes.
• Comply with record retention requirements as required by local law or other relevant legal or regulatory
  requirements.
• Defend, establish, exercise or bring any existing or potential legal claims.
• Ensure fraud detection and prevention.
• Respond to any queries or complaints you may have.
• With your consent, suggest roles that may be of interest to you.

We will delete your personal data when it is no longer required for these purposes. If there is any personal data that we are unable, for technical reasons, to delete entirely from our systems, we will ensure that appropriate measures are taken to prevent any further processing or use of the personal data.

6. INTERNATIONAL DATA TRANSFER

Because we operate as part of a global business, we may transfer, store, or process your personal data in a country different from where you reside. Your personal data may be processed in countries that are not subject to an adequacy decision by the European Commission or your local legislature or regulator, and that may not provide for the same level of data protection as your jurisdiction. In these instances, we put in place appropriate safeguards (such as the Standard Contractual Clauses) to ensure that your personal data is adequately protected.

7. CONTACT US AND CHANGES TO THE PRIVACY NOTICE

If you have questions or concerns regarding the way in which your personal data has been used or about this privacy notice, please contact the Privacy Team at [email protected].

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy you may have. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the local data protection authority or regulatory body in the country where you reside. If you reside in a country that is a member of the European Union or that is in the European Economic Area, you may find the contact details for your appropriate data protection authority on the following website.

We may modify or update this privacy statement from time to time. If we make a material change to this privacy statement, we will notify you of the change.

JANUARY 2022