Privacy Notice – Job seekers and applicants

PURPOSE OF THIS DOCUMENT

ZoolaTech Inc. and its affiliates (“ZoolaTech”, “we”) are committed to safeguarding your privacy and the security of your personal information.

This privacy notice explains how we collect and use your personal information during and after your application process, in accordance with the General Data Protection Regulation 2016 (“GDPR”) and other applicable laws and best practices relating to privacy.

Please note that this privacy notice applies to the processing of your personal data for employment or previous employment with ZoolaTech, as well as to your application for employment or to work as an independent contractor/consultant with our company. It also covers any other relationship you may have with us as a guest or external staff member who is not employed by ZoolaTech but has access to our facilities and/or corporate network.

We may update this privacy notice at any time. Whenever possible, we will notify applicants of significant changes to the privacy notice.

This privacy notice should be read in conjunction with the general privacy policy for the general use of our corporate websites, cookie notice, and other applicable ZoolaTech notices.

The relevant ZoolaTech entity responsible for the processing of your personal data is based on the country where the role for which you are applying is located. We have provided complete details of the relevant entities below. For example, if you apply for a role in Mexico, ZoolaTech’s Mexican entity (defined below) will be the data controller. We may share your personal information within the ZoolaTech group, and this privacy policy applies to any ZoolaTech entity processing your personal data as a data controller.

We are legally required to inform you of the contents of this privacy notice under data protection legislation.

This privacy notice does not establish a contractual relationship between you and ZoolaTech, whether as an employee or independent contractor/service provider, or in any other capacity.

It is crucial that you read this privacy notice to understand how and why we use your personal data.

THE TYPE OF DATA THAT WE POSSESS REGARDING YOU

Personal data, also known as personal information, refers to any information that can be used to identify an individual either on its own or in combination with other information. However, anonymous data, where the identity of the individual cannot be determined, is excluded from this definition.

Certain categories of personal data are considered more sensitive and require a higher level of protection. As part of our recruitment activities, we do not routinely collect, store, or use any special categories of personal data. However, if you notify us of a disability that meets the legal definition of a disability, we will only use that information to assess and implement any reasonable adjustments required by law.

We may collect, store, and use the following categories of personal information about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses;
• Date of birth;
• Your CV, professional social media profile such as LinkedIn, cover letter, application forms and other information regarding your employment history such as dates of employment, job titles, job descriptions, skills, reason for leaving, previous salary and benefits information, any websites or blogs you own or have contributed to, any photographs of you contained in your CV, areas of interests, notice periods/availability for employment;
• Your salary or remuneration package expectations and details of any offers of employment or work made by us to you and your responses;
• Interview history, questions, notes and technical assessment results;
• Your feedback on ZoolaTech’s recruitment process;
• How we obtained your data – from an application by you, through an agency or from a third party website that you had used to seek employment;
• CCTV footage from attendance at any ZoolaTech sites where we control the CCTV systems and any recordings of online video meetings, interviews or assessments;
• Any requests for reasonable adjustments or accommodations to comply with applicable equality legislation;
• Information to assess your right to work in the hire location, such as your nationality, work permit status including documentary evidence subject to local law and explicit consent, where required;
• Details of communications with you, how you interact with email communications and marketing communications;
• Your data privacy and marketing communications preferences;
• Any other information that you provide to us.

If you use your online profile we will also collect, store, and use the additional following categories of personal information about you, such as:

• Your username and data required for log-in;
• Your log in frequency and activity;
• What software, devices or hardware you use to access your profile;
• Your profile preferences and other forms you may complete in the online profile;
• Any privacy or communication channel and frequency preferences.

HOW IS YOUR PERSONAL DATA COLLECTED?

We mainly collect personal information about applicants from:

• Directly from you, such as using our website, other ZoolaTech online platforms or applications, email applications, or at a recruitment fair;
• From recruitment agencies that you are registered with and have agreed for them to provide us with your application information;
• From current ZoolaTech employees or contractors or other third parties , with your prior permission, as part of our internal or external referral program;
• From third party websites and job boards that you have used to seek employment;

From third party websites or platforms that help us obtain your contact details (if we do not already have it) or verify employment history from publicly available sources.

HOW WE WILL USE INFORMATION ABOUT YOU?

We only use your personal information for the following purposes and legal bases:

DATA SHARING

Where you are represented by a recruitment agency, we will share information about your recruitment activity (such as interview feedback, any offers, etc) so they can discuss this with you.

Due to the nature of ZoolaTech’s business, our clients may request anonymized summary CVs of applicants, including existing employees. While we aim to provide anonymized summaries, we may not always be able to do so. We will endeavor to notify you in advance of any such transfer.

In order to understand how we can improve our internal recruitment processes, we may use a third-party survey provider to (i) send you an invitation to a survey and or (ii) collect your responses. Typically, we only share your name and email address. Only team leaders and recruitment managers in ZoolaTech’s appropriate teams will have access to replies from applicants under their remit. Your replies will not affect the progress or outcome of any recruitment process with ZoolaTech.

We may also use third-party communication providers to help us manage communications around our recruitment and information campaigns.

Where we need technical testing of your skills, we may use third-party providers to undertake the testing on our behalf. We may typically share your name and contact information, primary skills, the role or the type of role you are applying for, and your resume or CV, if required.

We may also need to use third-party service providers, for example, to help us manage our applicant tracking system or to help host our websites or servers. We have contractual terms in place to protect your personal data.

We will share your data with other companies within the ZoolaTech group only for the purposes set out above. As ZoolaTech is a global company, we transfer the personal information we collect about you to our group companies in order to be able to consider you for other roles at ZoolaTech or with our clients and to administer our recruitment teams and systems.

However, to ensure that your personal information does receive an adequate level of protection we have put in place an intragroup data transfer agreement to ensure that your personal information is treated in a way that is consistent with and which respects the EU laws on data protection.

ZOOLA TECH LOCATIONS – DETAILS OF THE DATA CONTROLLER:

We may need to disclose all or any part of your personal information if required to do so by law, or pursuant to a request from a governmental or regulatory entity/body or if we believe in good faith that such disclosure is necessary to (1) comply with legal or regulatory requirements or for the purposes of compliance with legal process; (2) prevent crime; (3) prevent any terrorist activity or threat to national security; (4) protect the safety or wellbeing of users of our staff or any other person.

DATA SECURITY

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal information to those employees, contractors, and third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

DATA RETENTION

We will only retain your personal information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, and whether we can achieve those purposes through other means, and the applicable legal requirements.

After an unsuccessful application, we will aim to keep some or all of your personal data to the extent we need to for a period of 6 months after the last activity to consider you for any other job openings across the ZoolaTech Group and for legal/record-keeping purposes unless we are required to keep your data for a longer period by applicable law.

Consent to keep your information
ZoolaTech has asked you to consent to us storing your personal data after that initial period.
Where you have given us your consent, we apply the following retention guidelines to your personal data:

• After 6 months of no activity, we will minimize your personal data but at a minimum will retain your CV and information contained in it.
• Within two years of no activity, we will aim to contact you to understand whether there are any roles at ZoolaTech which may be suitable for you. We may also contact you at any point up to this period, if we consider we have a potentially suitable position for you and if you have opted in to receive any information generally about our recruitment campaigns.
• If we do not hear from you, we will either delete your profile or archive your profile and create a dummy profile with only one data field (such as your email address) to help link any future applications.

You may withdraw your consent to ZoolaTech retaining your personal data beyond the initial 6 months period after an unsuccessful application.

In some circumstances, we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

RECRUITMENT CAMPAIGNS

You can opt-in to receive information about our recruitment campaigns from ZoolaTech.
You may unsubscribe from these emails at any time by a) unsubscribing using our website, b) logging into your online profile, if you have one, or b) following the unsubscribe link on any recruitment campaign email from us.

We will take reasonable steps to unsubscribe you from these emails, but it may take up some time to take effect.

YOUR RIGHTS IN CONNECTION WITH YOUR PERSONAL DATA

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request the erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes such as our recruitment campaigns or “hot jobs” emails.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example, if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request the erasure of your personal information, object to the processing of your personal data or request that we transfer a copy of your personal information to another party, please contact us in writing.

No fee is usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

CALIFORNIA ADDENDUM – YOUR RIGHTS

If you are an employee, external staff member, or candidate that resides in California, this section applies to you and supplements the information shared in the privacy notice.

California residents have specific rights regarding their personal information under the California Privacy Rights Act (“CPRA”). This section describes your rights and explains how to exercise those rights. Please note that in the preceding twelve (12) months, we have not sold your personal information or shared such information for cross-context behavioral advertising. We may disclose certain personal information, such as your first and last name, employee identification number, email address, bank account details, job title/position, and other similar contact data, financial information, and employment details with our subsidiaries and affiliates and other third parties, including service providers who provide services on behalf of ZoolaTech.

You may request notice of and access to certain information about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable request, we may disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties with whom we disclosed that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).
• If we disclosed your personal information for a business purpose, a list of disclosures identifying the personal information categories that each category of recipient obtained.

You may request us to correct personal information about you that is inaccurate.

You may request that we delete the personal information that we collected from you and retained it, subject to certain exceptions. Once we receive and confirm your verifiable request, we will delete or de-identify (and direct our service providers to delete or de-identify) your personal information from our records, unless an exception applies.

None of these rights are absolute and there may be circumstances in which we are required or permitted under applicable law not to address your request.

Only you or an authorized agent that you authorize to act on your behalf may make a verifiable request related to your personal information.

Any verifiable request (including those to delete data) must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative (such as by requiring you to provide a signed written authorization that the agent is authorized to make a request on your behalf).
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable request does not require you to create an account with us.

QUESTIONS, REQUESTS, AND COMPLAINTS

If you want to review, verify, correct or request the erasure of your personal information, object to the processing of your personal data or request that we transfer a copy of your personal information to another party, please contact [email protected] in writing.

You have the right to make a complaint at any time to the supervisory authority for data protection issues in your home country.

February 28, 2023