Candidate Privacy Policy

I. Purpose of this Policy

This Candidate Privacy Policy (the "Policy") outlines the manner in which WA Technology and its Entities collect, use, process, and protect personal data of job applicants and candidates during the recruitment and application process. The Company and its Entities are responsible for deciding how to retain your personal information. You are provided with this information in accordance with this Policy because you are applying for a position with us (whether as an employee, worker, consultant, contractor or provider of services).

This Policy applies to applications submitted through:

• The Company Website, including through third party systems;
• Other recruitment routes, such as recruitment agencies, job boards, application tracking system Ashby and other means, such as email.

This Policy aims to convey how and why your personal information will be used, for the purposes of the recruitment exercise, and for how long it will be retained. It provides you with certain information that must be provided under the General Data Protection Regulation (EU) 2016/679) (GDPR) and the applicable laws of European Union countries, the United Kingdom, or other jurisdictions where applicable.

II. Definitions

• Data Processing: means any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
• Data Protection Legislation: means Directive 95/46/EC of the European Parliament and of the Counsel and/or Regulation 2016/679 of the European Parliament and of the Counsel (hereafter the "GDPR") where applicable, and/or local legislation on Personal data protection where applicable.
• Data Protection Officer (DPO): means a designated person responsible for overseeing data protection efforts within the Company.
• Data Subject: means any natural person whose Personal data is being collected, held or processed by Company.
• Company: means the Company with which any one Personnel member has entered into a contractual relationship with and shall include, unless specifically stated otherwise, any and all Company Entities listed in Annex A to this Policy. For the purposes of this Policy, it shall also include its affiliated, subsidiary and similarly related companies.
• Personal Data: means any information relating to an individual natural person directly or indirectly, in particular by reference to any identifier, that was lawfully received and controlled by the Company.
• Processing: means any operation or set of operations whether or not performed in an automated manner and applied to the data or data sets, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, circulation or any other form of disclosure, reconciliation or interconnection, limitation, elimination or destruction.
• Recipient: means, any person or legal entity, public authority, department or any other organization to which the Personal Data is communicated, whether a third party or not.
• Legitimate Interests: means a processing of personal data based on the legitimate interests pursued by the data controller or a third party.
• Sensitive Data: means the Personal data that differs from standard data (e.g., name and address) and contains private and often highly confidential information regarding the Data subject.

III. Scope

This Policy shall cover all operations of the Company and the Company Entities. This Policy applies to all Candidates of the Company regardless of their potential type of relationship (full-time/part-time/temporary employment, consultancy-based agreements, external agreements, etc.). For the purposes of this document, these individuals are collectively referred to as "Candidates". This Policy does not form part of the formal contract of employment or other contract for Candidates.

This Policy also applies to outsourcing organizations that perform information-processing services on behalf of the Company. Use of outsourcing organizations to process Candidates and Sensitive Data must always include a contractual commitment to consistently observe this Policy and related Company procedures and standards.

For the avoidance of doubt, this Policy shall not apply to Personal Data of customers of the Company, or other interested parties, such as suppliers, shareholders or visitors (for which the relevant Privacy Policy should be consulted).

IV. Information that might be collected

Candidate's information will be used by Company for the purposes of carrying out its application and recruitment process which includes:

• Assessing Candidate's skills, qualifications and interests against Company's career opportunities;
• Verifying Candidate's information and carrying out reference checks and/or conducting background checks (where applicable) if Candidate is offered a job;
• Communications with Candidate about the recruitment process and/or Candidate's application(s), including, in appropriate cases, informing Candidate of other potential career opportunities at Company;
• Creating and/or submitting reports as required under any local laws and/or regulations, where applicable;
• Where requested by Candidate, assisting Candidate with obtaining an immigration visa or work permit where required;
• Making improvements to Company's application and/or recruitment process including improving diversity in recruitment practices;
• Complying with applicable laws, regulations, legal processes or enforceable governmental requests;
• Proactively conducting research about Candidate background (educational and professional) and skills and contacting the Candidate if Company considers him/her suitable for a role with Company.

V. Principles for data processing

The Company is committed to complying with current regulations governing the Processing of Personal Data. In this regard, the Company undertakes to apply the following principles:

Collection of data for specific, explicit and legitimate purposesPersonal Data is collected and processed exclusively for the purposes and contexts described in Section I of this Candidate Privacy Policy. Any Processing of Personal Data carried out by the Company will have a legal basis that is relevant to the purposes of recruitment, and is limited to those purposes only as required by the GDPR or any other applicable legislation. The recruitment information shall not be used in any way that is incompatible with those purposes. The Company shall keep Candidate's personal information accurate, up to date and only for as long as it is necessary for the purposes.

Minimisation of data and limitation of the conservation periodThe Company will only collect Personal Data that is adequate, relevant and not excessive, in consideration of the purposes for which it is processed as described in Section 1. The Personal Data processed will only be kept for the time required for the purposes described in Section I and in accordance with applicable law regarding the conservation and storage of data.

Data securityThe Company will protect Personal Data from destruction, loss, manipulation, disclosure and/or unauthorized use. Consequently, technical and organizational measures, including without limitation access management and security of computer files (e.g., passwords, encryption) are adopted to guarantee the confidentiality, integrity and availability of Personal Data.

VI. The Type of Information That The Company Entities Process

In connection with Candidate's application the Company shall collect, store and use the following categories of personal information about the Candidate:

• The information the Candidate has provided to the Company in their CV and cover letter (if any), introductory letter and/or email.
• Information the Candidate has provided on the application form which provides information about the Candidate that is necessary for the Company to assess and decide if the Candidate is suitable for certain positions within the organization. This type of information may include: Candidate's name, title, address, telephone number, personal email address, date of birth, gender, immigration status and right to work in the country of application, employment history including history about Candidate's previous remuneration, qualifications, previous work history, personal interests, information about the type of work and projects Candidate has been a part of and any other information Candidate may wish to provide as part of their application.
• Any information the Candidate provides or is collected during an interview or, for example, information contained in their social networking accounts or personal websites or other online accounts (for example, LinkedIn or Twitter); information such as that provided by Candidate's references; performance and behavior reviews to the extent permitted by applicable law.
• Future Opportunity Information: This is information collected, with prior consent from the Candidate, to keep in touch with the Candidate about future job opportunities with the Company, such as their name, email, location, field of expertise, and the type of role the Candidate is interested in.
• Careers Website Information: This is information relating to Candidate's use of the Company Careers Website or the website and/or tools of the third party service provider that the Company uses (e.g. Ashby; Cezanne), including without limitation Candidate's IP address. This information may be collected using cookies and similar technology.

The Company may also collect, store, and use the following types of more sensitive personal information, as permitted by applicable law. Sensitive information may include, but is not limited to, details about the candidate's health, disability, ethnic origin, religious beliefs, criminal history, and other relevant personal characteristics.

VII. How is the Candidate's personal information obtained?

Company collects personal information about candidates from the following sources:

• The Candidate (for example, when they provide information as part of their application or during the recruitment process);
• The recruitment agency, including the recruitment services to which Candidate was redirected from our website, from which the Company collects the following categories of data: CV, name, address, date of birth, previous roles, passport copy, reasons for wanting to change roles or employment.
• Background check provider, for example a country's immigration authority, from which the Company may where applicable collect details of the Candidate right to work or live in a particular country;
• Candidate's references that provide details such as Candidate's previous employer/contractor, details of the role or work performed (e.g. job title) and the periods in which the Candidate was employed or performed the respective job/project;
• Third party data from a publicly accessible source: for example, LinkedIn or other business or employment services that operate through websites where the Candidate has added information about themselves; posts the Candidate has written/contributed to, and which are publicly available.

VIII. How Company shall use Candidate's information

1. The Company shall use the personal information we collect about a Candidate:

• To evaluate their skills, qualifications and suitability for the job or position, and generally to process your application;
• For security management, including background checks and reference checks, where applicable (including European and international anti-terrorism lists to the extent these checks go beyond any legal obligation applicable to us or any of the Company's Entities);
• To communicate with the Candidate about the recruitment process, including, where applicable, arranging travel/accommodation/travel expenses payments, regarding the interview process;
• To communicate with relevant Company Entities' Personnel about the recruitment process, as well as the recruitment agency that referred the Candidate to the Company;
• To maintain records related to the Company's recruitment processes, and where applicable, to further develop or improve any of our recruitment processes, including whether the Company's careers website is user-friendly and contains appropriate and useful information;
• To comply with legal or regulatory requirements, such as compliance with health and safety requirements and other legal or tax obligations, or in connection with litigation or an internal audit or investigation, as well as equal opportunity monitoring;
• Security checks and comparisons with European and/or international anti-terrorism lists to the extent legally permitted;
• For the enrichment of the Company's data, including by using or researching publicly available data to the extent this is necessary;
• To carry out relevant benchmarking, particularly regarding salary and other benefits that may be offered to the Candidate as part of the role or job;
• To allow the Candidate to participate in certain automated decision-making processes, where applicable, although any decision about the recruitment or otherwise of a candidate will always be made by a human being;
• For building and plant security (e.g. through access controls and video monitoring); Informatics security; compliance with health and safety requirements, where applicable.

2. Pre-Employment ScreeningThe Company may verify the personal information the Candidate provides and/or collect personal information about them from third party sources to assist with "Pre-Employment Screening". If this happens:

• The Candidate shall be informed in advance what aspects of their personal information will be verified, including an explanation of how pre-employment checks will be performed; and
• Personal information about criminal convictions (if collected) or medical information will only be collected through authorized official sources and in accordance with applicable law.

It is in the Company's best interest to decide whether to appoint a Candidate to a position or job or whether to offer a Candidate a role as a consultant or contractor. The Company Entities may process personal information relating to gender, race, ethnic origin, or physical or mental health, where the processing is required to comply with applicable law and/or necessary to identify or keep under review the existence or absence of equal opportunity or treatment.

3. In case the Candidate does not provide personal informationThe Candidate only needs to provide the personal information that is necessary to process their request or for a pre-contractual relationship with the Company, or where the Company is required by law to collect the information. Without this information, the Company generally cannot continue the job application process or selection procedure for the role in question.

4. How the Company uses Sensitive Personal InformationThe Company may gather sensitive information about a Candidate for lawful and valid reasons. These reasons include, but are not limited to, evaluating the Candidate's suitability for a specific role, adhering to equal opportunity and anti-discrimination regulations, and ensuring workplace safety. Before we collect any sensitive information, we will seek explicit consent from the Candidate.

IX. Sharing Data

The Company shall only share the Candidate's personal information with third parties solely for the purpose of processing and/or profiling the Candidate's application (including without limitation e.g. Ashby and Cezanne) and other companies, being Company's Entities and/or related entities to any of the Company's Entities.

The Company may also share the Candidate's personal information with recruitment agencies that submitted the Candidate's details to the Company. All of the Company's third party service providers shall be required to take appropriate security measures to protect the Candidate's personal information.

The Company may sometimes be required to disclose the Candidate's information to external third parties such as to local labor authorities, courts and tribunals, regulatory bodies and/or law enforcement agencies for the purpose of complying with applicable laws and regulations, or in response to legal process.

X. Data Storage

The Candidate's personal information obtained during the recruitment process may be transferred to, processed and/or stored in countries outside the country where the Candidate resides or lives, by the Company or by its service providers. If the Candidate resides in the United Kingdom or in an EEA country, or if the EU Commission has not issued any decision regarding the presence of a reasonable level of data protection for the country to which the Candidate's personal information will be transferred, the Company shall make sure that the Candidate's rights and freedoms will be reasonably protected and secured in accordance with EU / UK data protection requirements through contractual arrangements to this effect.

XI. Data Security

The Company has implemented appropriate security measures to prevent any personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, the Company limits access to the Candidate's personal information to employees, agents, contractors and other third parties who have a business need to know the Candidate's data. They shall only process the Candidate's personal information on the Company's instructions and are subject to a duty of confidentiality.

XII. Data Retention

The Company shall process and store the Candidate's personal information during their application as part of the Company's recruitment process. If the Candidate is unsuccessful in their application, the Company shall retain the collected personal recruitment information for no longer than is necessary. For data subjects who are covered by the GDPR, the Candidate's personal data is kept for a period of six (6) months after the Company notifies the Candidate that their application was unsuccessful, unless the Candidate allows the Company to retain their information for longer purposes.

XIII. Rights of Access, Correction, Deletion and Restriction

In certain circumstances, by law, the Candidate may have the right to:

• Request access to their personal information.
• Request correction of the personal information the Company holds about a Candidate.
• Request partial or full deletion of their personal information.
• Object to the processing of the Candidate's personal information where the Company is relying on a legitimate interest.
• Request restriction of processing of the Candidate's personal information.
• Request the transfer of the Candidate's personal information to another party.

If the Candidate wishes to exercise these rights, a request should be submitted to the Data Protection Officer at dpo@watechnology.com.

XIV. Right to Withdraw Consent

The Candidate has the right to withdraw their consent to processing at any time. To withdraw the given consent, the Candidate should contact dpo@watechnology.com.

XVII. Recording of Interviews for Internal Review and Analysis

1. Purpose of RecordingWA Technology and its Entities are committed to ensuring a fair, consistent, and effective recruitment process. To enhance our recruitment strategy, we may record audio and/or video of candidate interviews. The recordings will be utilized exclusively for internal review and analysis.

2. Consent for Recording InterviewsPrior to recording any interview, WA Technology and its Entities will obtain explicit and informed consent from candidates.

• Participation in the recorded interview is voluntary. Candidates will have the option to opt out of the recording process.
• Candidates have the right to withdraw their consent to the recording at any stage.

3. Purpose LimitationThe recorded interviews are strictly limited to the aforementioned purposes. Recorded interviews are considered confidential and will not be disclosed externally.

4. Data MinimizationWe will only record those parts of the interview that are essential for evaluating the candidate's suitability for the role and for internal feedback purposes.

5. Storage and SecurityAll recordings will be stored in a secure environment, with access strictly controlled and monitored. We will employ robust digital security measures, including encrypted storage systems and password protection.

6. Access ControlAccess to interview recordings is based on the principle of 'need to know'. Personnel are only given access to the information that is necessary to perform their job functions related to recruitment and candidate assessment.

7. Retention Policy for Interview RecordingsRecordings will be retained only for the period necessary to fulfill the purposes outlined in this policy. This period will not exceed 6 months, following the completion of the recruitment process for the respective candidate.

8. TransparencyCandidates will be clearly informed about the purposes of recording interviews, how they will be used, who will have access to them, and their rights regarding these recordings.

9. Rights of Data Subjects in Interview RecordingsCandidates can request access to their personal interview recordings. Candidates have the right to request the deletion of their interview recordings, especially when the data is no longer necessary.

10. Data TransferIn cases where interview recordings need to be transferred to locations outside the European Economic Area (EEA), we will ensure such transfers are conducted in compliance with the GDPR.

11. Compliance DocumentationWA Technology and its Entities will maintain accurate and up-to-date records of all interview recordings, including documentation of when and how consent was obtained.

XV. Data Protection Officer (DPO) and Contact Details

The Company has a Data Protection Officer (DPO) who may be contacted on dpo@watechnology.com.

XVI. Changes to this Privacy Policy

The Company may update this Policy from time to time. The updated Policy shall be placed on the website with the date of the last revision reflected.

Date of last revision: Jul 16, 2024

Annex A - Company Entities

The Company Entities to which this Policy applies are the following:

• DRAAD, LTD.
• Somos WATG Mexico S.A. de C.V.
• WAT Group BR LTDA
• W.A. Technology Group Ltd. Ireland
• W.A.T. Group, Lda.
• Betstudios Limited
• WA. Tech UK Ltd
• WAC Malta Limited
• WAC Latvia LLC

‍