1. Data Protection Principles

1. All processing of Personal Data shall be conducted according to the data protection principles as follows:
   1. Personal Data must be processed lawfully, fairly and transparently;
   2. Personal Data must be accurate and kept up to date with every effort to erase or correct;
   3. Personal Data must be processed in a manner that ensures the appropriate security.

2. Candidate Rights

1. Under certain circumstances, the Candidate may have rights under data protection laws in relation to its Personal Data which the Candidate can exercise free of charge. These rights include:
   1. The right to know whether we hold the Candidate’s Personal Data and to request access to its Personal Data held by us.
   2. The right to withdraw consent to the processing of its Personal Data at any time. Please note, however, that we may still be entitled to process a Candidate’s Personal Data if we have another legitimate reason for doing so. For example, we may need to retain Personal Data to comply with a legal obligation.
   3. The right to request that we rectify Personal Data if it is inaccurate or incomplete.
   4. The right to request that we erase Personal Data in certain circumstances. Please note that there may be circumstances where Candidates ask us to erase Personal Data, but we are legally entitled to retain it.
   5. In some circumstances, the right to receive the Personal Data provided to us in a structured, commonly used and machine-readable format and/or to instruct us to transmit that data to a third party.
   6. The right to object at any time to its Personal Data being processed for direct marketing and in other certain circumstances, such as if we change our legitimate interests from the basis on which we initially collected and processed the Candidate’s Personal Data.
   7. The right to lodge a complaint with the relevant data protection regulator if a Candidate thinks that any of its rights have been infringed by us.
2. If Candidates wish to exercise any of the above rights, or make any related complaint or request in relation to its Personal Data, please contact us by using the contact details below.
3. Further information about Candidate rights may be obtained by contacting the supervisory data protection authority located in the Candidate’s jurisdiction.

3. What information do we collect and why?

1. When a Candidate applies for a job or expresses interest for role, we may ask for:
   1. a Candidate’s name and contact details (like address, phone number and email address);
   2. the type of work the Candidate is looking for;
   3. a Candidate’s work and educational history (typically in a Candidate’s CV);
   4. the country a Candidate is applying from and the Candidate’s right to work status;
   5. Candidate responses to application questions and other information a Candidate gives us through potential take-home tasks;
   6. details of a Candidate’s current and/or desired salary and other things relating to compensation and benefits packages;
   7. audio, electronic, visual and other data collected when conducting interviews using Third Party Platforms (defined in section 6); and
   8. a Candidate’s current notice period.
2. If a Candidate is invited for an interview, we collect:
   1. details of any adjustments a Candidate wants us to make for the interview;
   2. any other information a Candidate gives us, or observations we make through interviews, that are relevant for a Candidate’s application;
   3. a form of identification, proof of address and current and previous addresses, right to work’ checks; and
   4. details about former managers or colleagues a Candidate wants us to contact as referees.
      ‍
      Providing this information is optional, but if the Candidate chooses not to, we might not have enough information to consider the Candidate’s  application.
3. We may also ask for the following ‘special category’ data, the Candidate’s provision of which is completely voluntary, and the data will remain anonymous:
   1. ethnicity
   2. gender identity
   3. sexual orientation
   4. disability & neurodiversity status.
4. How we will use and store this data is set out below.

4. Data we collect from external sources

1. We may also obtain a Candidate’s contact details and professional profile from:
   1. recruitment or executive search agencies; or
   2. professional networking sites or other public sources such as social media and job boards.
2. In connection with a Candidate’s application and the recruitment process we may also collect:
   1. the results of background checks from background checking agencies, this may include (if applicable) information about criminal convictions if a Candidate has a record and a Candidate’s immigration status; and
   2. references from previous employers, managers or colleagues.

5. How we use data during the recruitment process

1. In accordance with the applicable data protection laws, we only collect data where we have a lawful basis for using Candidate’s Personal Data. Since recruitment is a sensitive matter for both parties we have numerous bases for collecting data:
   1. We need to use Personal Data to enter into an employment contract, so we can:
      • Contact the Candidate during the hiring process
      • Carry out background checks
      • Consider the Candidate’s suitability for the role in question
      • Obtain references and vet information that a Candidate has given to us in a CV.
   2. We need to use Personal Data to comply with the law, so we can:
      • Make sure a Candidate has the right to work in the jurisdiction the Candidate is applying for
      • Run criminal background checks which are required by law for certain roles
      • Learn about a Candidate’s fitness and suitability for a Senior Manager Role.
   3. We need to use Personal Data when it’s in our ‘legitimate interest’, so we can:
      • Run our recruitment and promotion processes (including our Candidate tracking system)
      • Keep a copy of a Candidate’s application data if the Candidate wants to be considered for other roles. (See ‘Data Retention’ below.)
      • Share Candidate contact details with our travel provider if a Candidate needs to travel to an interview or stay at a hotel.
   4. We need a Candidate’s consent to use Candidate data, so we may ask:
      • To obtain a Candidate’s permission to carry out criminal background checks (unless Candidate is being considered for a Senior Manager and/or Non Executive Director role, in which case these checks are mandatory under the law).

6. Who May Have Access to Candidate’s Data

1. We may share a Candidate’s personal data internally within the Company such as with our affiliates, subsidiaries or employees which have a legitimate need to access a Candidate’s personal data and who are subject to duties of confidentiality;
2. We may share Personal Data with Third Party Platforms (which shall mean the software and services used during the recruitment process, these include):
   1. Greenhouse - this is our Candidate Tracking System where we store all Personal Data obtained throughout the recruitment process.
   2. Google Meet - we use this service to conduct our virtual interviews.
   3. Screenloop - we use this service to record our video interviews. The recordings captured by Screenloop are deleted three months after the interview.
   4. Recruitment agencies - we will share the outcome of a Candidate’s application so the agency can continue or stop notifying them of alternative opportunities.
   5. HackerRank - Candidate responses to the competency test will be processed by HackerRank and supplied to Goodnotes. We will make inferences based on this data that will help us differentiate Candidates with similar profiles.
3. In some limited circumstances, we may be legally required to share certain personal data if relevant to any legal proceedings or to comply with legal obligations, a court order, or the instructions of a government authority.

7. Data Protection

1. We will use reasonable technical and organisational measures designed to safeguard Personal Data, for example:
   1. we encrypt Personal Data;
   2. we conduct audits on our Third Party Platforms to ensure they abide with applicable data protection laws and will keep the Personal Data we share with them secure; and
   3. Any Personal Data that we process or store is done on secure servers.
2. In addition, we have reasonable security measures in place designed to prevent Personal Data from being accidentally or unlawfully lost, used or accessed. We limit access to Candidate Personal Data to those who have a genuine business need to access it. We take steps designed to ensure that those processing Candidate Personal Data will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to respond to data security breaches. We will notify Candidates and any applicable regulator of a suspected data security breach where we are legally required to do so.
3. However, since the Internet is not a 100% secure environment, we cannot guarantee, ensure, or warrant the security of any information, including Personal Data, Candidates share with us. There is no guarantee that information, including Personal Data, may not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards.

8. Data Retention

1. Unless otherwise stipulated, Candidate data will be retained by us for a maximum of twelve (12) months. We keep unsuccessful Candidates’ data for this period so we can notify of alternative roles in which the Candidate may be interested.
   
2. Candidates may opt out of this at any time.
   

9. Data Protection Officer