Ketch Applicant and Employee Privacy Notice

1. About this Notice

Ketch Kloud, Inc. and its affiliates ("Ketch", "we", "our") respect your privacy and have built a privacy programme that reflects the standards we ask our customers to expect from us. This notice tells you how we collect, use, disclose and protect personal information about people who apply to work at Ketch and people who work for Ketch - including employees, contractors, interns and similar personnel (collectively "you") - and about your dependents, beneficiaries and emergency contacts where we hold information about them.

It applies globally and is published on Ketch's careers site, attached to job listings, and made available to all personnel on the Ketch intranet. New hires are given a copy at onboarding. Country-specific points (US California; other US states; EU/UK; India) are addressed in Section 13.

This notice does not form part of any contract of employment, does not alter the at-will nature of employment where applicable, and may be updated from time to time as described in Section 15.

If you want to understand our privacy practices with respect to our services, our customers or other business partners, please visit https://www.ketch.com/privacy-policy.

2. Who is Responsible for Your Personal Information

The Ketch entity that contracts with you, or to which you have applied, is the controller of your personal information. Personal information is shared across the Ketch group for centralised HR, IT and corporate administration, subject to the safeguards in Section 9.

Jack Carvel is our worldwide Data Protection Officer (dpo@ketch.com). VeraSafe Netherlands BV and VeraSafe United Kingdom Ltd. are our representatives in the EU and the UK under Article 27 of the EU GDPR and the UK GDPR; their contact details are published in the Ketch Privacy Policy.

3. Categories of Personal Information We Collect

We collect and process the categories of personal information described below. We do not require all of this information at once; in any given interaction we collect only what is needed for the purpose described to you at the time.

We collect this information directly from you; from other Ketch entities (when you transfer or take part in group programmes); from third parties acting on your behalf or providing information about you (previous employers, references, recruiters, background-check (where permitted by law), right-to-work and benefits providers, educational institutions for degree verification); and through your interactions with Ketch IT systems, applications, devices and premises (including security logs, building-access records and CCTV footage in monitored areas). Where we request information that is necessary to comply with legal obligations, assess your candidacy, administer employment, provide benefits or otherwise manage the employment relationship, failure to provide the information may affect our ability to consider your application, enter into or continue an employment relationship, administer benefits, or comply with applicable law.

4. Sensitive Information

"Sensitive Information" means personal information that applicable law treats as deserving heightened protection. It includes special category data under Articles 9 and 10 of the EU and UK GDPR, Sensitive Personal Information under California Civil Code § 1798.140(ae), and equivalent categories under Indian and other applicable law. We collect Sensitive Information only where strictly necessary and where we have a lawful condition to do so.

The principal categories we process are:

• government-issued identifiers used for right-to-work, payroll and tax administration;
• account credentials and login data used to operate and secure Ketch IT systems;
• financial account information used to administer payroll and expenses;
• health information needed to administer leave, accommodation requests, occupational health, workers' compensation and benefits plans;
• racial or ethnic origin and other diversity data, where you choose to self-identify in voluntary surveys;
• religious or philosophical beliefs, only where you choose to provide that information (typically for a religious accommodation request);
• trade union or works council membership, only where you choose to share it; and
• criminal-record data, only where required or appropriate for the role and lawful for us to process under applicable law (in the UK, in reliance on Schedule 1, Part 2 of the Data Protection Act 2018; in other jurisdictions, in reliance on the corresponding national-law condition).

We do not collect biometric identifiers, precise geolocation outside the workplace, or genetic information. If our practices change, we will update this notice and obtain any consent required by applicable law (including Illinois BIPA and equivalent state biometric statutes) before any such collection begins.

5. How We Use Your Personal Information

We use your personal information for the purposes set out below. Detailed processing information, including the legal basis we rely on in respect of each purpose for EEA and UK personnel, is set out in Appendix B.

6. Legal Bases for Processing

Where applicable law requires us to identify a legal basis for our processing (including the EU and UK GDPR, the Swiss FADP and India's Digital Personal Data Protection Act, 2023 once in force), we rely on the following, depending on the purpose and the category of personal information:

• Performance of a contract / contractual necessity. Where the processing is necessary to enter into or perform the employment or service contract between you and Ketch.
• Compliance with a legal obligation. Tax, payroll, immigration, equal-opportunities reporting and similar mandatory obligations.
• Legitimate interests. Operating, securing and improving our business; managing the workforce; protecting our assets and people; participating in corporate transactions. The specific legitimate interests pursued in respect of each purpose are set out in Appendix B.
• Vital interests. To protect your or another person's life or health (for example, in a medical emergency).
• Consent. Limited cases such as publication of your name, photograph and biography externally, and voluntary self-identification surveys. You can withdraw consent at any time by emailing privacy@ketch.com; withdrawal does not affect processing carried out before withdrawal.

For Sensitive Information we additionally rely on the conditions in Article 9 EU/UK GDPR - in particular Article 9(2)(b) (employment), 9(2)(g) (substantial public interest, including the conditions in Schedule 1, Part 2 of the UK Data Protection Act 2018), 9(2)(f) (legal claims) and 9(2)(a) (explicit consent). For Criminal Conviction and Offence Data we rely on Article 10 in conjunction with the relevant national-law condition. Under India's DPDP Act (once in force) we rely on your consent or on a "legitimate use" within the meaning of Section 7, including for the purposes of employment.

7. Who We Disclose Your Personal Information To

We disclose personal information to the following categories of recipients:

• Ketch affiliates (Ketch Kloud, Inc., Ketch Kloud Limited and Ketch Kloud India Private Limited) - for centralised HR, IT and corporate administration, and for the operation of group-wide programmes (including share and equity plans);
• HR, payroll, benefits, pensions, equity-administration, learning, recruitment, applicant-tracking, performance-management and expense-management service providers;
• IT, security, hosting, cloud, telecommunications, communications and artificial-intelligence service providers;
• Customers, prospective customers and business partners where necessary in connection with your role and Ketch's business operations;
• Where permitted by law, background-check, reference-check, right-to-work, drug-test, sanctions and politically-exposed-persons screening providers (US background checks are also subject to the Fair Credit Reporting Act - see Section 14);
• Outside professional advisors (legal counsel, auditors, accountants, tax advisors and insurance brokers);
• Insurers and claims administrators, including workers'-compensation and disability-insurance carriers;
• Government agencies, regulators, courts and law-enforcement bodies, where required or permitted by law;
• Parties to actual or prospective corporate transactions, subject to confidentiality protections; and
• Other persons or entities to whom you ask or authorise us to disclose your personal information (for example, a mortgage provider seeking employment verification or a successor employer at your request).

Service providers and third parties are required by contract to use personal information only for the purposes for which it was disclosed, to protect it appropriately, and to comply with applicable law. Where required, we enter into the form of service-provider, contractor or processor agreement prescribed by the relevant jurisdiction.

We do not sell or share your personal information. Ketch does not "sell" or "share" personal information about applicants, employees or other personnel for cross-context behavioral advertising, as those terms are defined in California Civil Code §§ 1798.140(ad) and 1798.140(ah) or under any equivalent provision of any other US state privacy law as described in sections 13.1 and 13.2 (“US State Privacy Law”). We have not sold or shared personal information about personnel in the preceding 12 months, and we do not have actual knowledge of selling or sharing the personal information of any individual under the age of 16.

8. Automated Decision-Making and Artificial Intelligence

8.1 Automated Decision-Making

Ketch does not use automated decision-making - including AI-based screening, scoring, ranking or video-interview analysis tools - to make decisions about hiring, performance, promotion, discipline or termination that produce legal or similarly significant effects. All such decisions are made by human reviewers, who may be informed by reports and dashboards produced by Ketch IT systems.

If our practices change, we will: (i) update this notice, (ii) provide advance notice in accordance with applicable law (including the California Privacy Protection Agency's regulations on automated decision-making technology, New York City Local Law 144, the Illinois AI Video Interview Act, the Colorado AI Act and Article 50 of the EU AI Act), and (iii) obtain any consent required by applicable law before any such tool is deployed.

8.2 Use of Artificial Intelligence Tools

Ketch may use artificial intelligence ("AI") and machine-learning-enabled tools to support business operations, including recruiting administration, note taking, document management, customer support, software development, information security, productivity, research and analysis, and other workplace functions.

Where personal information is processed through AI-enabled tools:

• AI tools are used to assist Ketch personnel in performing their duties and are not used as the sole basis for decisions relating to hiring, promotion, compensation, discipline, termination or other employment-related actions.
• Where AI tools are used to assist with recruiting administration (including resume screening, interview note-taking or candidate communication), the tools are not used as automated employment decision tools within the meaning of New York City Local Law 144, the Illinois AI Video Interview Act, the Colorado AI Act or any equivalent statute, and no candidate is screened in or out solely on the basis of an AI tool's output.
• Material employment-related decisions are made by appropriately authorised human decision-makers who review relevant information and exercise independent judgment.
• Personal information may be processed by approved AI service providers acting on Ketch's behalf and subject to contractual confidentiality, security and data-protection obligations. Personal information processed by AI service providers is governed by contracts that prohibit those providers from using personnel personal information (including prompts, inputs and outputs) to train, fine-tune or otherwise improve their own models, except where Ketch has expressly opted in for a specific purpose.
• Ketch may use AI tools to generate summaries, recommendations, draft content, analyses or other outputs. Such outputs are reviewed, validated, modified or rejected by Ketch personnel before being relied upon.
• Ketch may use AI-enabled security, fraud-prevention and operational tools to detect threats, maintain system integrity, investigate incidents, and protect Ketch, its personnel, customers and business partners.

Ketch evaluates AI-enabled tools before deployment and implements appropriate governance, security and privacy controls designed to ensure that their use is lawful, proportionate and consistent with applicable data protection and employment laws.

If Ketch introduces AI systems in the future that make, or materially contribute to, decisions producing legal or similarly significant effects concerning personnel, Ketch will provide any notices, assessments, consultations, rights and safeguards required by applicable law.

9. International Transfers, Retention and Security

9.1 International transfers

Ketch operates globally. Your personal information may be transferred to and processed in the United States, the United Kingdom, the European Union, India and wherever a Ketch service provider operates. For transfers from the EEA, the UK and Switzerland we rely on the European Commission's 2021 Standard Contractual Clauses. Transfers between Ketch entities are subject to an Intra-Group Data Transfer Agreement incorporating the SCCs and the UK Addendum. For each material transfer route, a documented Transfer Impact Assessment is maintained.

9.2 Retention

We retain your personal information for as long as is necessary to fulfil the purposes set out in this notice, and for any further period required by applicable law (for example, tax, immigration, employment-records or anti-discrimination law) or recommended to defend against potential legal claims within the relevant limitation period. The default retention periods are set out in Appendix A. Where local law requires a shorter period (or, less commonly, a longer one), local law prevails. Records subject to a litigation hold or regulatory investigation may be retained longer. Personal information may remain in backup, disaster recovery and business continuity systems for a limited period after deletion from active systems in accordance with Ketch's backup and retention practices.

9.3 Security

Ketch operates an information security management system that is certified to ISO/IEC 27001:2022 and assessed annually under SOC 2 Type II by an independent auditor. We maintain administrative, technical, physical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Specific measures include role-based access control, multi-factor authentication, encryption in transit and at rest, centralised logging and monitoring, mandatory privacy and security training, background checks where lawful, and a documented incident response process. Access to your personal information within Ketch is limited to personnel and service providers who need it. If a personal data breach requires notification, we will notify you and the relevant regulator within the time required by applicable law.

10. Your Privacy Rights

Depending on the law that applies to you, you may have some or all of the following rights with respect to your personal information. The rights available to residents of particular jurisdictions are addressed in the country-specific provisions in Section 13.

• Right to access and to be informed. Request confirmation of whether we hold personal information about you and a copy of that information, together with information about how it is used.
• Right to correct. Request correction of inaccurate or incomplete personal information.
• Right to delete. Request deletion of your personal information, subject to legal exceptions (for example, where we are required by law to retain certain records).
• Right to restrict or object to processing. Request that we limit our processing, or object to processing carried out on the basis of our legitimate interests.
• Right to data portability. Receive a copy of certain personal information you have provided to us in a structured, commonly used and machine-readable format.
• Right to opt out of sale, sharing or targeted advertising. As explained in Section 7, Ketch does not sell or share your personal information.
• Right to limit use and disclosure of Sensitive Personal Information. Direct us to limit our use of Sensitive Personal Information to purposes permitted by CCPA § 1798.121. As explained in Section 4, we already use Sensitive Information only for those purposes.
• Right to withdraw consent. Where we rely on your consent, withdraw your consent at any time without affecting the lawfulness of any processing carried out before withdrawal.
• Right to non-discrimination and non-retaliation. Ketch will not discriminate or retaliate against you for exercising any of these rights.
• Right to appeal. Where applicable US State Privacy Law provides an appeal right (for example, in Virginia, Colorado and Connecticut), you may appeal a denial of any of the above rights as described in Section 11.
• Right to lodge a complaint. Lodge a complaint with the supervisory authority or attorney general's office in your jurisdiction. Exercising your rights will not, by itself, affect your application, your employment status, or the terms of your employment. Certain requests (for example, deletion) may, however, mean that we cannot evaluate your candidacy or continue your employment - we will explain the impact when we respond.

11. How to Submit a Privacy Request

You may submit a request to exercise any of the rights in Section 10 by emailing privacy@ketch.com or using the form at https://www.ketch.com/privacy-rights. This method is designated for the receipt of privacy requests under California Civil Code § 1798.130(a)(1) and equivalent provisions of other US State Privacy Laws.

11.1 Authorised agents

You may use an authorised agent to submit a request on your behalf. We will require: (a) written, signed permission from you authorising the agent; (b) verification of your own identity directly with Ketch; and (c) confirmation that you have provided the agent with permission. We may deny a request from an agent that does not submit proof of authorisation.

11.2 Identity verification

To protect your personal information, as permitted by law, we will take reasonable steps to verify your identity before fulfilling a request. If we are unable to verify your identity, we may decline the request, in which case we will tell you the basis for that decision.

11.3 Response timeframes

We will confirm receipt within 10 business days and respond to verified requests within the period required by applicable law - in any event, no later than 45 calendar days (extendable by a further 45 calendar days where reasonably necessary, with notice). For requests under the EU and UK GDPR, we will respond within one month (extendable by two further months where necessary, with notice).

11.4 Appeals

Where you believe we have improperly denied a privacy request, you may contact us at privacy@ketch.com and request an internal review by a member of the Ketch Privacy Team who was not involved in the original decision. We will respond within the time required by applicable law (typically 45 to 60 days).

12. Children and Related Persons

This notice is directed to adults. We do not knowingly collect personal information about applicants, employees or other personnel under the age of 16, except for limited Related Persons Data about a minor dependent (for example, your child's name and date of birth where required for benefits enrolment). We process Related Persons Data only as needed to administer benefits, leave, pay and emergency response, and we apply the same protections set out in this notice to that information. You are responsible for informing those individuals of this notice.

13. Country-Specific Provisions

The terms of this Section 13 apply in addition to, and where indicated in place of, the body of this notice for personnel based in or otherwise subject to the law of the relevant jurisdiction.

13.1 United States - California

California residents are protected by the California Consumer Privacy Act, as amended by the CPRA. The disclosures required by that Act (categories of personal information collected, sources, business purposes, categories of recipients, sale and share status, Sensitive Personal Information, retention periods and rights) are set out in Sections 3 to 11 and in Appendix A. We process Sensitive Personal Information only for the purposes permitted under California Code of Regulations title 11, § 7027(m); because we do not use Sensitive Personal Information beyond those permitted purposes, the right to limit under CCPA § 1798.121 is not engaged by our current practices. We will operate in conformity with the California Privacy Protection Agency's regulations on cybersecurity audits, risk assessments and automated decision-making technology as those regulations come into force.

13.2 United States - other states

The comprehensive consumer privacy laws of many US states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Jersey, New Hampshire, Minnesota, Maryland, Kentucky, Rhode Island and Nebraska) currently exempt personal information processed in an employment context. If any such law is amended to apply to applicant or employee data, the rights and obligations described in this notice will be extended to residents of the relevant state. Specific US state requirements that apply today:

• New York (Civil Rights Law § 52-c). Telephone, email and internet activity by New York-based personnel on Ketch electronic devices or systems may be subject to monitoring at any and all times by any lawful means. This notice is provided in writing on hire.
• Illinois BIPA, Texas CUBI, Washington and other state biometric statutes. We do not collect biometric identifiers from any personnel. If our practices change, we will adopt a written retention and destruction schedule and obtain written informed consent before collection begins.
• Two-party consent recording states. We do not routinely record telephone, video or in-person conversations. Where a call or meeting will be recorded, we provide clear notice at the start and obtain all-party consent where state law requires it (including in California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania and Washington).
• NLRA § 7. Nothing in this notice or Ketch's workplace policies is intended to restrict your rights under Section 7 of the National Labor Relations Act, including your right to discuss wages, hours and other terms and conditions of employment with coworkers.

13.3 European Union and United Kingdom

Personnel based in the EU or the UK benefit from the rights set out in the EU GDPR and the UK GDPR. Ketch Kloud Limited is the controller of your personal information; Ketch Kloud, Inc. acts as a processor in respect of certain centralised HR processes, under a written data processing agreement that meets the requirements of Article 28 EU GDPR / UK GDPR.

Where local law in an EU member state requires additional steps before we may undertake or change workplace monitoring or other processing, we comply with those requirements before introducing or changing the relevant activity.

EU and UK personnel may lodge a complaint with their national supervisory authority - for example, the Information Commissioner's Office (ICO; ico.org.uk) in the United Kingdom. Detailed processing information for EU and UK personnel is set out in Appendix B.

13.4 India

For personnel based in India, Ketch Kloud India Private Limited is the data fiduciary (controller). Until the Digital Personal Data Protection Act, 2023 (the "DPDP Act") commences and the corresponding rules are notified, we process personal information about India-based personnel in accordance with the Information Technology Act, 2000, the Sensitive Personal Data or Information Rules, 2011, and applicable Indian labour law. On commencement of the DPDP Act, we will provide DPDP-compliant notices, collect and process information on the basis of consent or a Section 7 "legitimate use" (including for the purposes of employment), and handle data principal rights and grievance redressal in the manner required by the Act. Grievances may be raised with dpo@ketch.com.

14. United States - Federal Law Compliance

14.1 Background checks (FCRA)

Where we obtain a consumer report or investigative consumer report about you, we follow the disclosure, authorisation and adverse-action procedures required by the federal Fair Credit Reporting Act (15 U.S.C. §§ 1681 et seq.) and equivalent state consumer-reporting laws. Those disclosures are provided to you separately at the time of the check.

14.2 Medical information (ADA, FMLA, GINA)

We keep medical information (disabilities, accommodation requests, leaves of absence and health-related benefits claims) in confidential files separate from your general personnel file, in the manner required by the ADA (42 U.S.C. § 12112(d)), the FMLA, and GINA (42 U.S.C. § 2000ff). Ketch does not request, require or use genetic information in employment decisions, and does not offer wellness programs that condition incentives on the disclosure of genetic information.

14.3 Group health plan information (HIPAA)

Personal information you provide to or that is collected through our group health plan is "protected health information" under HIPAA and is governed by the plan's Notice of Privacy Practices, not by this notice. Ketch implements the administrative, technical and physical safeguards required by the HIPAA Privacy and Security Rules where it has access to such information.

15. Updates and How to Contact Us

We may update this notice from time to time. We will post any updated version on Ketch's careers site and on the Ketch intranet, and will identify the new effective date at the top of the notice. Material changes will be communicated to you with reasonable advance notice. We will not make material changes that are retroactively applied without obtaining your consent where required by applicable law.

For questions, requests or complaints, please contact:

• Data Protection Officer: dpo@ketch.com
• Privacy Team: privacy@ketch.com
• Postal (US): Ketch Kloud, Inc., Attn: Privacy Team, 548 Market St PMB 62319, San Francisco, California 94104-5401, USA
• Postal (UK): Ketch Kloud Limited, Attn: Privacy, 5 New Street Square, London EC4A 3TW, United Kingdom
• Postal (India): Ketch Kloud India Private Limited, Office No. 201, Metropolis, Sr. No. 22/3 Balewadi, Pune, Maharashtra 411045, India
• EU Article 27 representative: VeraSafe Netherlands BV, Keizersgracht 555, 1017 DR Amsterdam, Netherlands. +420 228 881 031.
• UK Article 27 representative: VeraSafe United Kingdom Ltd., 37 Albert Embankment, London SE1 7TL, United Kingdom. +44 (20) 4532 2003.

Appendix A - Retention Periods

The retention periods set out below are default periods that we apply globally. Where local law in your jurisdiction requires a shorter period (or, less commonly, a longer one), local law prevails. Records subject to a litigation hold or regulatory investigation may be retained longer. Where a record is governed by more than one row, the longest applicable period applies.

Appendix B - Detailed Processing Activities and Legal Bases (EU/UK)

The table below sets out, for personnel based in the European Union or the United Kingdom, the detailed processing activities undertaken by Ketch, the categories of personal information typically used, and the legal bases relied upon.