Candidate Privacy Notice

Personal Information We Collect

A. Personal Information You Provide to Us

MotherDuck collects Personal Information about its Candidates to manage their application, assess their candidacy, and make an offer of employment to successful Candidates. The categories of Personal Information we may collect, use, transfer and disclose vary. These categories include:

• Personal Details. Name, Candidate identification number, work and home contact details (i.e., email, phone number, physical address), language(s) spoken, gender, date of birth, national identification card details, passport details, next of kin, disability status, emergency contact information, and photograph.
• Documentation Required under Immigration Laws. Citizenship, passport data, details of residency or work permit, and information required to issue an appropriate visa.
• Talent Management Information. Details contained your cover letter, application, and resume/CV (i.e., employment background, reference letters, education history, professional qualifications, language, and other relevant skills, certification expiration dates), employee or contractor screening and information necessary to complete a background check to the extent permitted by law, development programs planned and attended, e-learning programs, willingness to work in different locations or remotely, and driver’s license information where applicable.
• Personal Details. Name, Candidate identification number, work and home contact details (i.e., email, phone number, physical address), language(s) spoken, gender, date of birth, national identification card details, passport details, next of kin, disability status, emergency contact information, and photograph.
• Position Applied For. Description of position applied for, job title, management category, job code, job function(s), and sub-function(s).
• Special Categories of Information. We may also collect special categories of Personal Information where required or permitted by applicable law, such as health/medical information, place of birth/citizenship/nationality, information necessary to complete a background check, or trade union membership information. We collect this information for specific purposes, as described below.

B. Personal Information We Receive from Third Parties

How We Use the Personal Information We Collect

We will use your Personal Information for one or more of the following purposes:

• Managing Applications. Managing applications, including assessing your suitability for the position applied, reviewing your previous experience and reference letters, conducting interviews with you, conducting background checks, discussing and making decision on your application, and preparing an employment agreement.
• Communications. Facilitating communication with you and keeping you informed about your application.
• Business Operations. Maintaining internal records about Candidates who apply for each position and whether they have re-applied in the past.
• Compliance. Complying with legal and other requirements, record-keeping and reporting obligations, physical access policies, conducting audits, compliance with government inspections and other requests from government or other public authorities, responding to a legal process (such as a court order or subpoena), pursuing legal rights and remedies, defending litigation and managing any internal complaints or claims, conducting investigations, and complying with internal policies and procedures.
• Special Categories of Information. We may also collect special categories of Personal Information for specific purposes, including collection of health/medical information in order to accommodate a disability or illness in case an employment offer is made and diversity-related information in order to monitor compliance with legal obligations and internal policies relating to diversity and anti-discrimination.
  
  If you do not provide certain Personal Information, MotherDuck may not be able to achieve some of the purposes outlined above.
  

Legal Bases for Processing European Personal Information

If you are located in the European Economic Area (“EEA”) or the United Kingdom (“UK”), we only process your Personal Information when we have a valid “legal basis.” The bases on which we may collect and process your Personal Information include:

• Consent. You have consented to our processing of your Personal Information to manage and assess your application.
• Contract Performance. We need to process your Personal Information to take steps to enter into a contract with you.
• Compliance. MotherDuck’s legal obligations.
• Legitimate Business Interests. MotherDuck’s legitimate business interests, including general human resource administration, general business operations, disclosures for auditing and reporting purposes, internal investigations, contractual obligations with third parties, management of network and information systems security, and the protection of MotherDuck’s assets.
  
  MotherDuck does not collect or otherwise process special categories of Personal Information (which may include information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, criminal records, criminal proceedings, or health or sex life), except where:
  
  

How We Disclose the Personal Information We Collect

• MotherDuck Personnel. Access to, use of and other processing of Personal Information generally will be limited to individuals who have a need to know the information for the purposes described in this Notice, which may include your potential managers or supervisors, as well as personnel in HR, IT, Compliance, Legal, Finance and Accounting, and Internal Audit. Most personnel within MotherDuck will have access to your business contact information such as name, position, telephone number, work address, and email address.
• Third Parties and Service Providers. From time to time, MotherDuck may make Personal Information available to other entities, such as legal and regulatory authorities, outside professional advisors, and service providers (such as providers of human resources services, IT systems and support, cloud storage providers, and other third parties engaged to assist MotherDuck in carrying out business activities).
• As Required by Law. We also may disclose Personal Information to third parties other than service providers: (i) if we are required to do so by law, regulation, or legal process (such as a court order or subpoena), (ii) in response to requests by government agencies, or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity.
• Affiliates and Business Transactions. MotherDuck may disclose your Personal Information to MotherDuck affiliates to fulfil the purposes described in this Notice. We may also transfer your Personal Information in the event that we sell or transfer all or a portion of our business or assets (including in the event of a reorganization, dissolution, or liquidation). Some of these transfers may be to parties in countries outside of the country and region in which you work.

Cross-Border Data Transfers

MotherDuck may transfer your Personal Information to locations in the United States and other countries that have different data protection laws than those in the country in which you are based or work and that may not provide the same level of protection for your Personal Information, including to countries that have not been found to provide adequate protection by the European Commission or by the UK Government, as appropriate.

Please note that by submitting your application, you are transferring your Personal Information to the United States, where MotherDuck is based.

Information Security and Integrity

We have in place appropriate legal, organizational, physical and technical measures that are designed to improve the integrity and security of Personal Information that we collect and maintain and to protect Personal Information in conformity with applicable privacy and data security laws. As required by applicable law, when MotherDuck retains a third-party service provider, that provider will be required to use measures to protect the confidentiality and security of the Personal Information and process the Personal Information only as directed by MotherDuck.

To the extent required by applicable law, we take reasonable steps to ensure that the Personal Information we process is reliable for its intended use, is accurate, up-to-date and complete, and is limited to the Personal Information required to carry out the purposes of the processing, as described in this Notice.

Data Retention

We will retain your Personal Information only for as long as necessary to fulfil the purposes outlined in this Notice unless a longer retention period is required or permitted by applicable law. When determining the retention period, MotherDuck considers various criteria, such as the services offered by you, mandatory retention periods provided by law, and the relevant statute of limitations.

European Personal Information Rights, Questions, and Complaints

Subject to applicable law, if you are located in the EEA or the UK, you have certain rights with respect to our processing of your Personal Information, which include the right to:

If you would like to exercise any of these rights that apply to you, ask a question, or raise a complaint regarding the processing of your Personal Information by MotherDuck, please contact MotherDuck’s people department at jobs@motherduck.com. Please note, however, that certain Personal Information or certain uses of your Personal Information may be exempt from these rights pursuant to applicable data protection laws. MotherDuck may also refuse to act or may impose limitations on your privacy requests if, for instance, your request is likely to adversely affect the rights and freedoms of MotherDuck or others, prejudice the execution or enforcement of the law, interfere with pending or future litigation, or infringe applicable law.

You have a right to lodge a complaint with the data protection authority in your country if you feel that your Personal Information has been mishandled.

Contact Information

If you have any questions, comments, or concerns about our processing activities, please email us at info@motherduck.com or write to us at:

• MotherDuck Corporation
• 113 Cherry St
• PMB 77153
• Seattle, Washington 98104-2205