Recruiting Privacy Policy

1. Data Controller

o37 Group is the data controller responsible for the personal data collected through this talent pool form. You can reach us regarding any data-related inquiries at:

Email: careers@o37group.com

2. What Data We Collect

When you submit an application to our talent pool, we may collect the following categories of personal data:

• Identity information: Full name, email address, phone number, and location.
• Professional information: Resume or CV, work history, education, skills, and any other information you choose to provide in the form.
• Video recording: A short video recorded by you as part of the application process.
• Technical data: IP address, browser type, and device information collected automatically when you access the form.
• Any additional information you voluntarily include in your submission.

3. How We Use Your Data

We use the personal data you provide for the following purposes:

• Talent evaluation: To assess your qualifications, experience, and potential fit for current or future roles within o37 Group or its portfolio companies.
• AI-assisted evaluation: We use internal tools powered by third-party AI models (including those provided by OpenAI and Anthropic) to assist in evaluating candidate submissions. These tools may process your application data, including your video recording, to help assess suitability for roles. AI-assisted evaluation is used to support, not replace, human decision-making.
• Communication: To contact you when a suitable opportunity arises.
• Legal compliance: To comply with applicable laws and regulations.

4. Video Recordings

As part of your application, you are required to record a short video. By submitting the form, you expressly consent to the recording, storage, processing, and AI-assisted evaluation of this video for the purposes described in this policy.

Your video will only be viewed by personnel directly involved in evaluating candidates and may be processed by the AI tools described in Section 3. We will not publicly distribute your video recording.

If you are a resident of Illinois, please note: We do not use biometric identifiers derived from your video (such as facial geometry scans or voiceprints) for identification purposes. If this practice changes in the future, we will obtain your written consent as required under the Illinois Biometric Information Privacy Act (BIPA) before any such processing occurs.

5. Sharing Your Data

We do not sell your personal data. We may share your data with the following parties:

• o37 Portfolio Companies: With your consent, we may share your application data with companies within the o37 portfolio for the purpose of evaluating you for roles within those companies. You will be asked to provide this consent separately, and you may decline without affecting your standing in the o37 talent pool.
• Service Providers: We use Tally (tally.so) as our form provider to collect your application data. We also use third-party AI model providers (OpenAI and Anthropic) to assist in candidate evaluation. These providers act as data processors on our behalf and are contractually obligated to protect your data and use it only for the purposes we specify.
• Legal Requirements: We may disclose your data if required to do so by law, regulation, legal process, or governmental request.

6. Data Retention

We retain your personal data for a maximum of 36 months from the date of your submission. After this period, your data will be permanently deleted unless:

• You have provided renewed consent to remain in our talent pool.
• We are required to retain certain data to comply with legal obligations.

You may request deletion of your data at any time before the retention period expires by contacting careers@o37group.com. We will process your request within 30 days.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. While no system is completely secure, we take reasonable steps to safeguard your information.

8. Your Rights

Depending on your location, you may have some or all of the following rights regarding your personal data:

All applicants:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of any inaccurate or incomplete data.
• Deletion: Request that we delete your personal data.
• Withdrawal of consent: Withdraw your consent to data processing at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, contact careers@o37group.com. We will respond within 30 days.

Additional rights for residents of the European Economic Area (EEA) and the United Kingdom:

If you are located in the EEA or UK, the legal basis for processing your data is your explicit consent (Article 6(1)(a) of the GDPR). You also have the right to:

• Data portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Restriction: Request that we restrict the processing of your data under certain circumstances.
• Objection: Object to the processing of your personal data.
• Lodge a complaint: File a complaint with your local data protection authority if you believe your rights have been violated.

If you withdraw your consent, we will cease processing your data and delete it within 30 days, unless we are legally required to retain it.

Additional rights for residents of California:

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting the information, and the categories of third parties with whom we share it.
• Right to delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt out: You may opt out of the sale or sharing of your personal information. We do not sell your personal information.
• Non-discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

9. International Data Transfers

o37 Group is headquartered in the United States. If you are submitting your application from outside the United States, your personal data will be transferred to and processed in the United States, where data protection laws may differ from those in your country of residence. By submitting your application, you consent to this transfer. Where required by applicable law, we will ensure appropriate safeguards are in place to protect your data.

10. Automated Decision-Making

We use AI-assisted tools to help evaluate candidate submissions. These tools are used to support human review and do not make fully automated decisions that produce legal or similarly significant effects on you. A human reviewer is involved in all final decisions regarding your candidacy.

If you are located in the EEA or UK, you have the right not to be subject to a decision based solely on automated processing under Article 22 of the GDPR. You may contact us at careers@o37group.com to request information about the logic involved in any automated processing of your data or to request human review of any automated assessment.

11. Children

Our talent pool is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you by updating the date at the top of this policy. Your continued inclusion in our talent pool after any changes constitutes your acceptance of the updated policy.

13. Contact Us

For any questions, concerns, or requests related to this policy or your personal data, contact us at:

Email: careers@o37group.com