Introduction

This privacy notice sets out how and why Samaya AI processes data that identifies or is associated with you ("personal information"), and your rights in relation to that information, when you submit an application to join our team.

It is important that you read and understand this notice. If you have any questions or require further information, please contact the operations team using the contact details in paragraph 3 of this privacy notice.

Who is responsible for your personal information?

The Samaya AI group consists of Samaya AI, Inc and Samaya AI UK Limited. If you are applying to join our team in the UK, Samaya AI UK Limited and Samaya AI, Inc. will be joint controllers of the personal information that we collect and use as set out in this privacy notice. This means that we jointly determine and are responsible for how this personal information is used.

Please refer to the Annex for further information about how Samaya AI UK Limited and Samaya AI, Inc have allocated responsibility for complying with our obligations under applicable data protection law.

Samaya AI UK Limited and Samaya AI, Inc. are, collectively, referred to as "Samaya AI", "we", "our" or "us" in this privacy notice.

Contact points for data protection queries

Please contact the operations team at [email protected] if you have any questions, comments, concerns and requests regarding this notice.

Personal information we collect about applicants

Personal information you provide with your application

We will collect the following categories of personal information about you in connection with your application for work with us, either from you directly or from the recruitment or employment agency that refers your application to us. The types of personal information we collect will vary depending on the nature of the position and role you are applying for:

• Personal contact details, such as your name, phone number, address and e- mail address.
• Job application information, such as position applied for, previous roles, job description, responsibilities and assignments, years of service, qualifications and experience, and other information contained in your CV.
• Nationality, citizenship and right to work information, such as country of birth, government identification documents (including passports and residency permits) and, where relevant, visa information.
• Any other data provided by you in the course of the application process, including electronic communications with you in relation to the application process.

When we collect your personal information, we will inform you if the information is mandatory or optional. If you do not provide any information which is marked as mandatory, we will not be able to process your application successfully.

The table in the Annex sets out further details about how we use the above information and, for applicants to our UK team, the legal basis we rely on for processing that information.

Information contained in records that we create ourselves

As part of your application process, we will also create interview evaluation and appraisal information, interview evaluation and appraisal information,

The table in the Annex sets out further details about how we use the above information and, for applicants to our UK team, the legal basis we rely on for processing that information.

Information we collect through pre-employment vetting

If we decide to offer you employment or engage you as a consultant, we may contact your professional and academic referees to confirm the employment, professional and academic information that you have provided to us. You should ensure that you have any referees' consent to disclose information about you to us when you submit your application.

We will inform you if we obtain any information in this way that could affect our decision to offer you employment or appointment. We will give you the opportunity to respond to the information obtained and will take your response into account when deciding whether to proceed with your appointment.

The table in the Annex sets out further details about how we use the above information and, for applicants to our UK team, the legal basis we rely on for processing that information.

If apply to join our US team, Samaya US, Inc may also collect the results of any checks against public or government databases before we make a formal offer to you. This information is not shared with, accessed by or processed by Samaya UK. We do this in order to verify your identity and identify if your engagement as a team member would pose a risk to us, our reputation, our customers or other team members. Depending on the nature of your role, such pre-employment screening information will include one or more of the following:

• Background and criminal records check;
• Search against public registers, such as the sex offenders registry and global watchlist;
• Social Security Number Trace, to verify your identity and validity of your social security number.

Consent

We are not required to obtain your consent for most of the processing activities that we undertake in respect of your personal information.

We may, however, need your consent in limited circumstances for some uses of certain personal information. If we do need your consent, we will notify you separately of the personal information we intend to use and how we intend to use it.

You will never be obliged to give us this consent. Where you have given us consent to collect, use or disclose your personal information in a certain way, you may withdraw your consent at any time. If you wish to withdraw any consent that you have given us, please contact the operations team using the contact details in paragraph 3 of this privacy notice.

Keeping you information up to date

As your circumstances change, please inform us of any changes to your personal information so that we can ensure that the personal information we store about you is accurate and up to date.

How long we keep your personal information

Unless a longer retention period is required or permitted by law, we will only hold your personal information for the following periods:

Personal information	How long we keep it
Information you provide as an applicant or that we generate about you ourselves in connection with your application.	If your application is unsuccessful, or if you withdrew your application, we will keep this information for the following periods: if you are applying to join our UK team, 12 months from the date you or we informed the other of their decision not to proceed with your application; if you are applying to join our US team, 4 years from the date you or we informed the other of their decision not to proceed with your application. If your application is successful, we will keep this information for the duration of your employment or engagement to the extent it is relevant to your ongoing employment or engagement with us.
Information collected through pre-employment vetting, as set out in paragraph 4.	We will generally only retain the results of the pre- employment vetting we have carried out (i.e. whether you have passed the relevant checks). If your application is unsuccessful, or if you withdrew your application, we will keep this information for the following periods: if you are applying to join our UK team, 12 months from the date you or we informed the other of their decision not to proceed with your application; if you are applying to join our US team, 4 years from the date you or we informed the other of their decision not to proceed with your application. If your application is successful, we will keep this information for the duration of your employment or engagement to the extent it is relevant to your ongoing employment or engagement with us.

Recipients of personal information

We may share your personal information with the following:

Recipient	How they use it
Service providers: we may share your personal information with third party vendors and other service providers that perform services for us or on our behalf, which may include providing mailing or email services, data hosting and record keeping services, and payments processing. Such information may be disclosed: to providers of human resources management software and business collaboration tools; to providers of our IT infrastructure and storage.	These recipients will use your personal information as processors only on our instructions. They may also aggregate and anonymise information to monitor the performance of, identify errors in, and improve their services. The lawful basis relied on for such transfers is that the processing is necessary for the relevant service provider's legitimate interests, namely to maintain and improve their services.
Advisors: we may share your personal information with our advisors in connection with obtaining professional services such as legal, financial and accountancy services on behalf of Samaya AI.	These recipients will use your personal information in order to provide us with legal or financial, accountancy or tax advice. The lawful basis we rely on for such transfers is that the processing is necessary for our legitimate interests, namely obtaining professional services and advice.
Purchasers and third parties in connection with a business transaction: your personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business.	These recipients will use your personal information to assess the potential transaction with us. They may also use your personal information to facilitate the integration of our prospective team members into their structure in the event of an acquisition or to progress an existing application. The lawful basis we rely on for such transfers is that the processing is necessary for our and the third party's legitimate interests, namely assessing and executing a potential transaction with us.
Law enforcement, government bodies, regulators and other parties for legal reasons: we may share your personal information with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with law and/or reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements; and/or (iii) exercise or protect the rights, property, or safety of Samaya AI,	These recipients will use your personal information in the performance of their regulatory or law enforcement role, or to advise us in connection with a potential claim or regulatory enforcement action. The lawful basis we rely on for sharing personal information with these recipients is that the processing is either necessary to comply with a legal obligation to which we are subject or is necessary for our legitimate interests, namely enforcing our rights or complying with requests from regulatory authorities.

Storing and transfering your personal information

Security. We implement appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, change or damage. All personal information we collect will be stored on secure servers. Where we transfer personal information to our service providers, we will enter into agreements with those service providers that require those recipients to implement appropriate technical and organisational security measures to protect your personal information.

International Transfers of your Personal Information. The personal information we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have operations. We will ensure that these international transfers of your personal information are made pursuant to appropriate safeguards, such as:

• ensuring that the personal information is only transferred to countries recognised as offering an equivalent level of protection as compared to the level of protection in the country you are located ("Adequacy"); or
• the transfer is made pursuant to agreements incorporating standard data protection clauses adopted by the European Commission and approved under the UK Data Protection Act 2018 ("SCCs").

Your personal information may be processed by recipients in the following countries:

Destination country	Safeguard user
United States	SCCs and / or transfers to recipients certified under participation in the EU-U.S. Data Privacy Framework (“DPF”), UK Extension to the EU-U.S. DPF, and Swiss- U.S. DPF.

If you wish to enquire further about the safeguards we use, including obtaining a copy of any SCCs that we have entered into, please contact the operations team using the contact details in paragraph 3 of this privacy notice.

Your rights in respect of your personal information

You have the following rights in respect of your personal information that we hold:

• Right of access. You have the right to obtain:
  • confirmation of whether, and where, we are processing your personal information;
  • information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods;
  • information about the categories of recipients with whom we may share your personal information; and
  • a copy of the personal information we hold about you.
• Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal information to another person.
• Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.
• Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.
• Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
• Right to object. You also have a right, in some circumstances, to object to any processing based on our legitimate interests. There may, however, be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case.

If you wish to exercise one of these rights, please contact the Samaya AI operations team, using the contact details at the end of this privacy notice.

If you wish to exercise one of these rights, please contact the Samaya AI operations team, using the contact details at the end of this privacy notice.

You also have the right to lodge a complaint to the Information Commissioner's Office – please see https://ico.org.uk/make-a-complaint/ for more information.

Changes to this notice

We may update this notice from time to time. When we change this notice in a material way, we will update the "last modified" date above.

Details of processing

How responsibility is shared between Samaya AI UK Limited ("Samaya UK") and Samaya AI, Inc ("Samaya US")

We have allocated responsibility for complying with our obligations under applicable data protection law as follows:

• Information about how we use your personal information: if you submit an application to join our UK team, Samaya UK will provide you, on behalf of both Samaya UK and Samaya US, with information about how your personal information is used by us as joint controllers. If you submit an application to join our US team, Samaya US will provide you, on behalf of both Samaya UK and Samaya US, with information about how your personal information is used by us as joint controllers.
• Your rights: the entity to which you submit an application will serve as the primary contact point for exercising your rights in respect of the personal information we process as joint controllers (as further described in the "Your rights in respect of your personal information" section above). If you would like to exercise your rights in respect of your personal information, you can do so by contacting us using the details in the "Contact point for data protection queries" section above.
• Security: Samaya UK and Samaya US will each store and maintain safeguards to ensure that the personal information we process as joint controllers is kept secure.
• Lawfulness: Samaya UK and Samaya US have determined the lawful basis relied on for processing your personal information as joint controllers, as set out below.
• Transfers: we have implemented safeguards for the transfers of your personal information between Samaya UK and Samaya US, including transfers outside of the jurisdiction you are in, as set out in the "Storing and transferring your personal information" section above. Samaya US implements safeguards for onward transfers to service providers engaged on behalf of Samaya US and Samaya UK.

Personal information you provide with your application

Personal information	How we use this information	Legal basis for processing
Personal contact details, such as your name, phone number, address and e-mail address.	We use this information to open and maintain applicant records.	The processing is necessary for our legitimate interests, namely managing job applications for positions with Samaya AI.
	We use this information to communicate with you as part of the recruitment process.	The processing is necessary for our legitimate interests, namely communicating with applicants and managing job applications for positions with Samaya AI.
	If your application is successful, we will use this information to contact you in relation to your offer.	The processing is necessary in order to take steps prior to entering into a contract with you.
Job application information, such as position applied for, previous roles, job description, responsibilities and assignments, years of service, qualifications and experience, and other information contained in your CV.	We use this information to process and assess your application, including assessing your suitability for a role.	The processing is necessary for our legitimate interests, namely assessing the suitability of candidates for roles at Samaya AI.
	We use this information to calculate proposed salary and assessing eligibility for certain benefits.	The processing is necessary in order to take steps prior to entering into a contract with you.
	We use this information to monitor and improve our application process.	The processing is necessary for our legitimate interests, namely reviewing and updating our applications process.
Nationality, citizenship and right to work information, such as country of birth, government identification documents (including passports and residency permits) and, where relevant, visa information.	We use this information to determine your eligibility to work.	The processing is necessary for compliance with a legal obligation to which we are subject, namely the Immigration, Asylum and Nationality Act 2006.
	We use this information to fulfil our obligations to relevant government authorities.	The processing is necessary for compliance with a legal obligation to which we are subject, namely the Immigration, Asylum and Nationality Act 2006.
Any other data provided by you in the course of the application process, including electronic communications with you in relation to the application process.	We use this information to process and assess your application, including assessing your suitability for a role.	The processing is necessary for our legitimate interests, namely assessing the suitability of candidates for roles at Samaya AI.
	We use this information to respond to your enquiries and to monitor and improve our application process.	The processing is necessary for our legitimate interests, namely managing applications and improving the application process.

Information contained in records that we create ourselves

Personal information	How we use this information	Legal basis for processing
Interview evaluation and appraisal information, such as comments and notes made by interviewers or other employees in connection with your application	We use this information to process and assess your application, including assessing your suitability for a role.	The processing is necessary for our legitimate interests, namely assessing the suitability of candidates for roles at Samaya AI.
	We use this information to calculate proposed salary and assessing eligibility for certain benefits.	The processing is necessary in order to take steps prior to entering into a contract with you.

Information we collect through pre-employment vetting

Personal information	How we use this information	Legal basis for processing
Employment history and professional qualification verification. We may contact your professional and academic referees to confirm the employment, professional and academic information that you have provided to us. You should ensure that you have any referees' consent to disclose information about you to us when you submit your application.	We use this information to process and assess your application, including assessing your suitability for a role.	The processing is necessary in order to take steps prior to entering into a contract with you.