Candidate Privacy Notice

PRIVACY NOTICE FOR CANDIDATES

At Oath we are committed to protecting the privacy of individuals submitting personal information to us. Oath will collect necessary information to process your employment application with the company or affiliated entities (collectively, "Oath" "we", "us" or "our"). An "affiliate" is any company that is controlled by or under common control with Oath Inc., Oath Holdings Inc., and Yahoo Holdings International B.V. For a list of Oath's major contact brands, please visit Oath brands. For information about the Oath entity (or entities) that is the controller responsible for your information, please click here.

The purpose of this privacy notice ("Notice") is to provide you with information about how we process your personal information when you provide information directly to us (for example, via a job application or to a recruiter), when an existing Oath employee refers you to us, or when you make your information publically available (for example, on career networking and job search sites).

Information we collect

In order to consider you for roles at Oath, we need to process certain personal information about you which includes, but is not limited to, the following:

• your personal details and contact information, which may include your name, address, email, telephone number and proof of identity;

• your recruitment and applications details, which may include information contained in CVs or letters of application, data related to your work history, education, qualifications, compensation, skills, nationality and your right to work, occupational interests, reference information, etc.;

• assessment details: for example, if we ask you to attend an interview (either in person or by telephone or video) or ask you to complete assessments, including online 3rd party assessments, we may generate information about you;

• results of pre-employment checks and vetting (for example, if we make you a conditional offer of employment, we will consider the results of these checks where permitted by local law);

• if voluntarily disclosed or required by law, information about your health or disability status (which are considered to constitute special categories of personal data) relating to an accommodation that is disclosed during the recruiting process.

In addition, Oath may view and process information you make publicly available on various career networking and job search sites, such as LinkedIn. This information may be considered when assessing your employment application with Oath.

Oath will request information related to the position you're applying for. Please ensure the information you provide is accurate and is not in any respect misleading, deceptive or likely to mislead or deceive. If we make you a conditional offer of employment, where permissible by local law, we will verify the information provided by you as part of the recruitment process and any resulting employment may be withdrawn/terminated if it is inaccurate.

While the application process is voluntary, the provision of certain information is mandatory (and may be required under applicable law or in accordance with a contractual requirement). The collection of any such information will be made clear at the time of collection of the information. If you choose not to submit this information to Oath, this may affect your application.

How we use this information

The above information will be processed for the purposes of progressing your application and assessing the suitability of candidates for employment at Oath. In doing so, Oath is pursuing its legitimate business interests of hiring suitable candidates and seeking assurances from previous employers and referees as to candidates' work performance and reliability.

Unless you object, we shall also keep this information for a period of 12 months so that we can contact you about current and future positions at Oath. This is necessary in the legitimate interests of Oath to maintain a talented workforce. During the hiring process, we may ask if we can retain information about you for a longer period of time. We will only do this with your express consent and information about you can be removed at any time on your request.

We may also use your information to analyse and improve the recruiting process and as required to comply with applicable legal or regulatory requirements. For example, if we make a conditional offer of employment, we may be required to confirm the identity of our personnel and their right to work in a particular country under immigration and employment rules.

We may also carry out pre-employment screening and background check investigations where required by applicable law and/or where necessary in Oath's legitimate interests to hire trustworthy candidates.

Oath will also request information needed to comply with the laws of the country where the position is located. Where this is required, you may be asked to provide a response to the information requested, which may include, but is not limited to, voluntary information on gender, ethnic or racial background. This information constitutes special categories of personal data. This information is processed in certain countries to enable Oath to comply with its equal employment opportunities legal requirements. This information is not available to Oath employees making candidate selection decisions, but is available to those responsible for accessing this kind of information to comply with the relevant legal requirements.

We may process special categories of personal data (for example, if you voluntarily disclose data about any disability or health condition which you may have) where necessary for the establishment, exercise or defence of a legal claim by us or where necessary for the purpose of carrying out our obligations and for the exercising of our rights or your rights in the field of employment or social security law. You may also provide explicit consent to Oath to enable Oath to process this type of data as part of the hiring process.

How we share this information

Oath, when necessary and in accordance with the purposes of processing set out in this Notice, will share your information with affiliates and third parties in order to progress your application and to conduct and improve the recruiting process. For example, we share information with the following categories of third parties:

• Recruitment service providers (including online recruitment platforms)

• Pre-employment screening service providers

• Applicant tracking system providers

• Applicant/recruitment assessment providers

• Immigration and employment lawyers and consultants

When we outsource the processing of your personal data to third parties or affiliates or provide your information to third party service providers or affiliates to process it on our behalf, we require those third parties to protect the personal data they are provided with appropriate security measures and prohibit them from using information for their own purposes or from disclosing the information to others.

When you use third-party apps, websites or other products integrated with our systems to apply for a role, they may collect information about you subject to their own terms and privacy policies.

Data Transfers

Oath is part of a global service so it shares information with affiliates and third parties based outside the European Economic Area ("EEA") for the purposes described in this Notice. The United States and other non-EEA countries all have different laws on data protection and rules in relation to government access to information. If you are based in the EEA, when your data is moved from your home country to a third country outside the EEA some of these countries may not have the same data protection safeguards as your home country.

These transfers are necessary for Oath's recruitment operations. Oath relies on Standard Contractual Clauses which have been approved by the European Commission and on the European Commission's adequacy decisions on certain countries to transfer your information from the EEA (link to EC adequacy decisions). For additional information about Oath's Standard Contractual Clauses please contact Oath's Data Protection Officer at emea-privacy@oath.com.

Security and Retention

Oath maintains appropriate technical and organisational measures to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal information. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.

If you are successful in your application, the information you provide during the application process may be retained as part of your employee file. We will retain this information for as long as is required in order to comply with our legal obligations and to resolve disputes and to enforce our agreements. If you are unsuccessful, we will retain the information you provided so that we can comply with our legal obligations, to resolve disputes or, for a 12 month period (unless you have agreed that we can retain information about you for a longer period of time) in order to contact you about current and future opportunities at Oath.

Your Rights

You have a number of rights as regards the information we collect and hold about you for the purposes set out in this Notice. These rights include the right to access or port your personal information, correct inaccuracies in your personal information, the right to restrict or limit the way in which we use your personal information.

In certain circumstances, you have the right to object to the processing of your personal data held by us. You can request that we delete the personal data that we hold about you and we will carry out this request, except for where exceptional circumstances exist that require us to hold on to certain information.

If you have any questions about this Notice, or if you require further information about our use of your personal data or you wish to avail of any of your rights set out herein, please contact Oath's Data Protection Officer at emea-privacy@oath.com.

Finally, you also have the right to lodge a complaint with a supervisory authority in the EU member State in which you are based. The following provides a link to the European Commission website list of National Data Protection Authorities (Link to EC National Data Protection Authorities List).

Changes to this Notice

This Notice may be updated from time to time. If we make changes that are material we will notify you either by prominently posting a notice of such changes before they take effect or by directly sending you a notification.

Updated May 2018