Candidate privacy notice.

Article IGeneral

I.1Purpose of the privacy statement

Protecting your data is very important to Cnuic. This privacy statement informs you of how Cnuic handles your personal data if you apply for a position at Cnuic, as an employee, contractor, intern or student.

You are recommended to read this privacy statement carefully to have an overview of your rights and if you have any questions about this privacy statement, you can contact Cnuic at people@cnuic.com.

Cnuic always processes your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation.

I.2Data controller

Cnuic Technologies Ltd (hereinafter: “Cnuic”), a company registered in Scotland under company number SC845429, with its registered office at Citypoint, 3^rd Floor, 65 Haymarket Terrace, Edinburgh, United Kingdom, is the data controller for the personal data processed during its recruitment process.

I.3Amendments

This privacy statement may be amended or added to. You are therefore recommended to check regularly for amendments that are or could be relevant to you. The date of the most recent version is shown at the top of this statement.

Article IIPersonal data collection

Cnuic may collect certain personal data from you when you apply for a position at Cnuic. Specifically:

• Identification data, such as your first name and surname
• Contact details, such as your e-mail address, address and telephone number
• Data on your career and education/training, such as your CV, your professional role(s), the training/education you have received, your publications or portfolio, and your profile (employee, contractor, intern, student, etc.)
• Assessment data, such as interview notes and the results of technical tasks or tests completed during the recruitment process
• Financial data, such as your current salary or benefits, and your salary expectations within Cnuic
• Right-to-work data, such as your nationality, immigration status and passport or visa details
• Photos and videos, such as the use of video calls during the application process
• Data provided by your referees
• Diversity data, such as your gender or ethnicity, only if you choose to provide it (see Article V.2)
• Data concerning criminal convictions, only for certain roles and only after a conditional offer (see Article V.5)
• Data you provide in your CV or cover letter

Most of this personal data is provided by you directly. Cnuic may also receive personal data from recruitment agencies, referees you nominate, employees who refer you, publicly available professional profiles relevant to the role, and screening providers acting on Cnuic’s behalf.

Article IIIPurposes of processing and legal bases

Cnuic collects your personal data as a candidate for the following purposes and on the following legal bases under Article 6 of the UK GDPR:

• To be able to identify and contact you about your application, and to take steps at your request before entering into a contract with you (contractual necessity).
• To be able to assess your application based on certain necessary parameters, as well as some parameters that you can choose whether or not to share with Cnuic (contractual necessity and Cnuic’s legitimate interest in recruiting suitable candidates).
• To make reasonable adjustments to the recruitment process where you need them (legal obligation under the Equality Act 2010).
• To verify your right to work in the United Kingdom (legal obligation).
• To comply with export control, sanctions and other compliance legislation that may apply to Cnuic’s recruitment process (legal obligation and legitimate interests).
• To be able to contact you about future vacancies or recruitment events organised by Cnuic (your consent).
• To establish, exercise or defend legal claims (legitimate interests).

Where Cnuic relies on its legitimate interests, it has balanced those interests against your rights and freedoms. You may request further information about this assessment.

Cnuic does not make recruitment decisions based solely on automated processing, including profiling. Every application is reviewed by a member of Cnuic’s team.

If you do not provide certain personal data that Cnuic needs, such as proof of your right to work, Cnuic may not be able to continue with your application.

Article IVStorage period

Cnuic processes and stores your personal data only for as long as it is legally obliged to do so or for as long as necessary for the purposes of the processing. In particular:

• If your application is unsuccessful, Cnuic retains your personal data for 6 months after informing you of the outcome, so that it can respond to any questions or legal claims.
• If you have consented to Cnuic keeping your details for future vacancies, Cnuic retains them for up to 2 years, or until you withdraw your consent.
• If your application is successful, your personal data will be transferred to your personnel file and processed in accordance with Cnuic’s employee privacy notice.

After these periods, Cnuic securely deletes or anonymises your personal data. As the data subject, you may request the erasure of your personal data (or some of it) at any time, as set out in Article VII.

Article VAccess to and transfer of personal data

V.1Access to personal data

Within Cnuic, your personal data will only be available to employees who need this access to ensure that Cnuic is able to assess your application appropriately, such as hiring managers, interviewers and the founders.

V.2Diversity & Inclusion

Cnuic is committed to creating a diverse and inclusive workplace and to eliminating potential bias in its recruitment process. For this reason, Cnuic may invite you to answer optional diversity questions, for example about your gender, ethnicity or disability. You may always choose “prefer not to say”.

Some of this information is “special category data” under the UK GDPR. Cnuic only processes it with your explicit consent, or where necessary to meet its obligations in employment law, such as making reasonable adjustments. Cnuic only uses this information in anonymised reporting after the recruitment process, to evaluate equality at every stage and adapt its way of working. Hiring managers and interviewers never have access to this information.

V.3Transfer to third parties

Cnuic may call on third parties to process your personal data to handle and follow up your application, such as its applicant tracking system provider BambooHR, video-conferencing and e-mail providers, assessment platforms, recruitment agencies and screening providers. These third parties act only on Cnuic’s instructions.

Cnuic will neither sell, lease, distribute nor in any other way make your personal data available to third parties for commercial gain, unless expressly provided for in this privacy statement or with your express consent.

Cnuic guarantees a similar level of protection of your personal data by enforcing contractual obligations on these third parties that are equivalent to those in this privacy statement.

In the event of a full or partial reorganisation, investment in, or transfer of Cnuic’s business, your personal data may be shared with or transferred to new entities or third parties, subject to confidentiality obligations. Cnuic will inform you of this in advance where possible.

V.4International transfers

Some of Cnuic’s service providers may process your personal data outside the United Kingdom. Where this happens, Cnuic ensures an adequate level of protection, for example by transferring personal data only to countries covered by UK adequacy regulations, or by using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You may request a copy of the relevant safeguards.

V.5Legal obligations

In rare instances, Cnuic may have to reveal your personal data pursuant to a court order or to comply with other binding laws or regulations. Cnuic will make all reasonable efforts to inform you of this in advance, unless this is subject to legal restrictions.

To comply with applicable export control and sanctions laws and regulations, Cnuic may screen job applicants against sanctioned party lists. For this purpose, your personal data may be processed in relevant databases, including databases of third-party vendors that perform this screening for or on behalf of Cnuic.

For certain roles, Cnuic may carry out a criminal record check (such as a basic disclosure) after making a conditional offer, where permitted by law. Cnuic will inform you before doing so and processes this data in accordance with the conditions set out in the Data Protection Act 2018.

Article VISecurity measures

Cnuic has taken appropriate technical and organisational measures to ensure that your personal data is protected against unauthorised access and unauthorised amendment, publication or deletion. The main measures are:

• Cnuic limits access to your personal data to those employees and service providers who need it, and they are bound by confidentiality obligations.
• Cnuic has incorporated data protection by design and by default into its internal procedures, so that security and data protection risks are addressed from the outset.
• Cnuic uses security technologies, such as encryption and access controls, to protect its systems against internal and external threats.
• Cnuic regularly evaluates its working methods with regard to the collection, storage and processing of information, including physical and logical security measures.
• Cnuic’s employees receive guidance on how to handle personal data in their day-to-day work.

If a personal data breach is likely to result in a risk to your rights and freedoms, Cnuic will notify you and the Information Commissioner’s Office where required by law.

Article VIIYour rights

VII.1Right of access

You have the right to request at any time a copy of the personal data Cnuic holds about you, and information about how Cnuic uses it.

VII.2Right to rectification, erasure and restriction

You are free to share certain personal data with Cnuic or not, and you have the right at all times to ask Cnuic to rectify your personal data if you believe it is inaccurate or incomplete.

You may also request a restriction of the processing of your personal data, or ask Cnuic to erase your personal data, in the circumstances set out in the UK GDPR. Cnuic may, however, no longer be able to consider your application, in whole or in part, if you refuse to share certain personal data or if you ask Cnuic to erase it.

VII.3Right to object

You have the right to object to the processing of your personal data where Cnuic relies on its legitimate interests, on grounds relating to your particular situation.

VII.4Right to data portability

You have the right to receive the personal data you have provided to Cnuic in a structured, commonly used and machine-readable format, and to have it transmitted to another organisation, where technically feasible.

VII.5Right to withdraw consent

Where Cnuic relies on your consent, you have the right to withdraw it at any time. This does not affect the lawfulness of processing carried out before you withdrew it.

VII.6How to exercise your rights

If you wish to exercise your rights as the data subject, you may contact Cnuic at people@cnuic.com. Cnuic will handle your request within one month, as required by law. This period may be extended in limited circumstances, in which case Cnuic will inform you. There is normally no charge.

VII.7Complaints to the Information Commissioner’s Office

If you think that Cnuic has not adequately addressed, or has incorrectly handled, your request or your personal data, you may lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection authority. This is without prejudice to your civil rights.