Information Notice on the Processing of Personal Data for European Job Applicants

Effective Date: February 1, 2020

Last Reviewed on: February 12, 2020

About Us

Aera Technology, Inc., a limited liability company with headquarters in Mountain View, California, USA,together with its relevant local European subsidiaries amongst the list below, acting as co-controllers (further, “Aera”, “us”, “we” or a similar reference):

• Aera Software Technology S.R.L., a limited liability company with headquarters located in Bucharest, 201 Barbu Vacarescu Street, 10th floor, District 2, Romania, hr@aeratechnology.com;

• Aera Technology SAS, a limited liability company with headquarters in Paris, 13 Rue du Docteur Lancereaux 5th Floor 75008, France, hr@aeratechnology.com;

• Aera Technology Limited, a limited liability company with headquarters in London, Suite 1, 3rd Floor 11-12 St. James Square UK SW1Y4LB, hr@aeratechnology.com; and

• Cognitive Aera Software GmbH, a limited liability company with headquarters in Munich, Widenmayerstr. 6 c/o Boetticher RAs 80538, Germany, hr@aeratechnology.com

collect and process several categories of personal data from our applicants and possible interns (hereinafter “you”) in compliance with the European Union data protection law.

The protection of your personal data is very important, and we treat this seriously.

This Notice describes our policies and practices regarding our collection and use of your personal data when you apply for a job within Aera, and also sets forth your rights. Please read this Notice carefully.

1. How We Collect and Process Your Peronal Data

Within Aera, we collect and use the following data which concerns you, referred to in this document as “personal data”:

1.1 Information included in your resume / curriculum vitae (“CV”) and any additional information provided by you to us in this context, such as: full name, domicile/residence/correspondence address, email address, phone number, previous employers, job responsibilities, achievements, previous projects, recommendations, analysis of your professional career progression and skills, training, department changes, details regarding your job performance and your ability to fulfill job requirements.

We will use such data during the recruitment process, at your request, before signing the employment agreement, including to contact you for interviews. We are taking these steps, at your request, before the conclusion of an agreement.

1.2 The results of the verifications and background checks we complete in order to validate your professional credentials, your eligibility for employment, and the veracity of the information you have shared with us throughout the recruitment process. This may include information about your identification; entitlement to work; citizenship or right of permanent residence; education and academic credentials; past employment; professional qualifications, registrations or sanctions; whether you are included on any official sanctions lists; criminal background; and information available from public and subscription media sources, both print and online (such as LinkedIn). Additionally, we may perform reference checks and ask for recommendations based on the information you provide us (i.e. the name and e-mail address of persons willing to provide feedback on your professional conduct and fit for the role).

We use the above data in our legitimate interest to confirm the information in your resumes, CVs, bios and letters of intent, as well as for carrying out verifications regarding your previous performance. We also have an interest in maintaining the good reputation of Aera, and therefore we deem it important to verify whether an applicant is or has been involved in any litigation which might affect our reputation. In cases where we use a service provider for professional background check services, we will request your consent for such verifications before we initiate the check. If Aera does not receive these data, this may prevent us from fulfilling our duties and obligations as a recruiter

1.3 Should you come for an interview at one of our European offices, please note that we use video surveillance systems in the premises of some of our offices. The purpose of these systems is to ensure the security of premises, assets and persons in our premises. Thus, we carry out security verifications based on our legitimate interest.

In case you are selected for a position within Aera, you will be provided with a separate notice on personal data processing for our employees.

Personal data source: Some of the personal data processed is provided directly by you, and other information is obtained indirectly from third parties, such as recruitment agencies and providers, recommendations, and public sources (e.g. LinkedIn, court website).

2. Disclosure of Your Personal Data

2.1 Distributing the data within the Aera group of companies: Your personal data may be distributed to any other company that is a member of the Aera group, for internal group administrative purposes or where we consider that it is in our legitimate interest to do so for improving our recruitment process within the group and identifying the most appropriate candidates for job openings within the group.

Access to your personal data is limited to those persons who need to know this information for professional purposes. They may include the department/team and their designees for the fulfilment of certain tasks, as well as employees in the human resources, recruitment, compliance, corporate services, legal, IT, security and financial departments.

2.2 Data disclosure to third parties: We will share your personal data, on a need-to-know basis only with the following categories of third parties:

(a) other entities such as regulatory authorities, accountants, auditors, lawyers or other external experts, where their activity requires such information; and

(b) companies that provide products and services to us, such as: human resources services, for preemployment verifications; recruitment agencies; information technology systems suppliers and related support services suppliers, including email archiving, back-up and disaster recovery, cyber security services.

We will also disclose your personal data to third parties in the following cases:

(a) if you request or authorize us to do so;

(b) to persons demonstrating legal authority to act on your behalf;

(c) where it is in our legitimate interest to do so in order to run, grow and develop our business: (i) in case of a transfer of undertaking (we sell a part of the business or certain assets) related to the job you apply for, we may disclose your personal information to the prospective buyer of such business or assets, in order to ensure that the activity continues as a going concern; (ii) if Aera (or a substantially part of its assets) are acquired by a third party, in which case personal information held by Aera will be one of the transferred assets;

(d) if we are under a duty to disclose your personal information in order to comply with any legal obligation or any lawful request from public authorities;

(e) to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent any illegal activity;

(f) to protect the rights, property or safety of Aera, its employees, customers, suppliers or other persons.

Some of these recipients (including our affiliates) may use your data in countries which are outside of the European Economic Area. Please see section 4 below for more details on this aspect

2.3 The third parties with whom we share your personal information pursuant to the above paragraphs are limited by law and/or by contract in their ability to use your personal information. We will always ensure that any third parties with whom we share your personal information voluntarily are subject to privacy obligations (for the avoidance of doubt, this cannot be applicable where the disclosure is imposed by a legal obligation or public authority).

3. Rentention of Your Personal Data

Your personal data is kept only for as long as needed for the fulfilment of the purposes for which such information is processed. The personal data of the applicants who are not employed is kept for a period of 2 years from the end of the recruiting phase, which we reasonably deem to be necessary. In this period, we may contact you in relation to other jobs available that we invite you to apply for. Nevertheless, if you wish us to erase your data sooner, you may request this at any time, in the manner indicated in section 6.

The images taken from surveillance cameras are kept for a maximum of 90 days from the recording date, unless an incident is reported during the 30 (thirty) days, in which case the parts of the video related to such incidents are kept for 3 years from the date when the incident was finally solved (for the purpose of protecting our rights).

The personal data of applicants who are employed are subject to a distinct policy.

4. Transfers of Your Personal Data Outside of the EEA

The personal data may be processed by third parties operating outside the Economic European Area (European Union, Iceland, Norway and Liechtenstein), for the purposes mentioned in section 2. In such cases, we will take appropriate measures to ensure that the recipient protects your personal information adequately. These measures include:

(a) in the case of United States of America (USA) entering into European Commission approved standard contractual arrangements with them, or ensuring they have signed up to the Privacy Shield (see further details at https://www.privacyshield.gov/welcome);

(b) in the case of service providers based in other countries outside the Economic European Area, entering into European Commission approved standard contractual arrangements with them or making sure their country of registration is considered adequate from a data protection point of view by the European Commission.

5. Security

Aera is committed to protecting personal information and takes all reasonable precautions to safeguard the confidentiality of personal information, including through the use of appropriate organizational and technical measures. Organizational measures include physical access controls to our premises (including CCTV), staff training and keeping physical files in locked rooms or cabinets. Technical measures include use of encryption, passwords for access to our systems and use of anti-virus software.

In the course of provisioning your personal data to us, your personal information may be transferred over the internet, notably through the use of a third party, such as a jobber platform, website or any social media. Although we make efforts to protect the personal information which you provide to us, the transmission of information through these platform and websites is not completely secure. In such case, we cannot guarantee the security of your personal information transmitted to us.

6. Your Rights

As a data subject, you have specific legal rights relating to the personal data that we collect from you. Aera will respect your rights and will deal with your concerns adequately.

(a) Right of access: You may ask from us information regarding personal data that we hold about you, including information as to the categories of data, what they are being used for, where we collected them, if obtained indirectly, and to whom it has been disclosed, if applicable.

(b) Right to rectification: You may ask us to rectify the incorrect or incomplete information which we process about you.

(c) Right to restriction: You may obtain from us restriction of processing of your personal data, if:

• you contest the accuracy of your personal data, for the period we need to verify the accuracy;

• the processing is unlawful, if you request the restriction of the processing instead of the erasure of your personal data;

• we do no longer need your personal data, but you request it for the establishment, exercise or defense of legal claims; or

• you object to the processing while we verify whether our grounded reasons override yours.

(d) Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another controller, solely within the limits of art. 20 of the GDPR.

(e) Right to delete data: You may request to delete the personal data we process about you. This right is applicable if:

i. the personal data is no longer required for the purposes for which it has been collected;

ii. you oppose processing for reasons related to your particular situation;

iii. the personal data has been processed unlawfully;

iv. the personal data must be deleted to comply with a legal obligation that we have unless data is required:

• for the exercise of the right to free expression and information;

• to comply with a legal obligation that we have;

• for purposes of archiving in the public interest, scientific or for historical studies or for statistical purposes; or

• for ascertaining, exercising or defending a right in court.

(f) Right to opposition: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless (i) we can demonstrate compelling legitimate grounds which justify the processing and override your interests, rights and freedoms, or (ii) in case the purpose is the establishment, exercise or defence of a right in court.

Time period: We aim to respond to your request within one month. This period may be extended, due to the complexity of your request, with a maximum additional period of 2 months. In all cases, if this period is extended, we will inform you about the term of extension and the reasons that led to it.

No identification: In some cases, we may not be able to identify your personal data due to the identifiers you provide in your request. In such cases, where we cannot identify you as a data subject, we are not able to comply with your request in accordance with this section, unless you provide additional information enabling your identification. We will inform you and give you the opportunity to provide such additional details.

Contact Details

In case you have additional questions, or you wish to exercise any of the rights you have in relation to your data, please contact us at the following contact details:

By email at hr@aeratechnology.com

By post / courier at:

• Aera Software Technology S.R.L., Attention: Human Resources, 201 Barbu Vacarescu Street, 10th floor, District 2, Bucharest, Romania; or

• Aera Technology SAS, Attention: Human Resources, Rue du Docteur Lancereaux 5th Floor 75008, Paris, France; or

• Aera Technology, Inc., Attention: Human Resources, 707 California Street, Mountain View, California, USA 94041

Aera will use all reasonable efforts to resolve or reply to the complaint or request regarding the processing of your personal data.

If you are not satisfied with our reply, you may also make a complaint to:

• In Romania: The Romanian National Supervisory Authority for Processing of Personal Data (Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal), Tel. +40.318.059.21, email: anspdcp@dataprotection.ro, Website: www.dataprotection.ro ;

• In France: Commission Nationale de l'Informatique et des Libertés – CNIL, Tel. +33 1 53 73 22 22 , Website: http://www.cnil.fr/ ;

• In Germany: Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, Tel. +49 228 997799 0; +49 228 81995 0, email: poststelle@bfdi.bund.de ; Website: http://www.bfdi.bund.de/ ;

• In the United Kingdom: The Information Commissioner’s Office, Tel. +44 1625 545 700, email: casework@ico.org.uk ; Website: https://ico.org.uk

This notice is applicable as of the date above. We reserve the right to modify, where we deem appropriate, the privacy practices and update and make changes to this notice at any time. Any changes to this notice will be displayed through any means we deem appropriate, including by posting it on the Aera website.