Dataiku Candidate Privacy Notice

1. About this notice

This Notice explains how Dataiku and its affiliated entities (together, "Dataiku", "we", "us") collect, use, and protect personal information about individuals who apply for positions with us. It applies to all candidates worldwide, regardless of the role or location they apply for. The Dataiku entity to which you are applying is the data controller responsible for your personal information. The identity and registered address of the relevant Dataiku entity are indicated in the job posting or, if not stated there, may be obtained by contacting [email protected].

This Notice applies only to personal information that we collect from or about you in the context of your application. It does not extend to third-party websites or services through which you may have applied or been referred, such as LinkedIn or other professional platforms. Those third parties operate under their own privacy policies, which we encourage you to read.

2. Information we collect

We collect personal information that you provide directly, that we receive from third parties in connection with your application, or that we generate during the recruitment process. This includes:

Personal details

Name and title, gender, birth date, national identification number, home address, home/personal phone number and email address, proof of identification and address, and marital status.

Not all of the above data is collected at the application stage. During the selection phase, we collect only the information necessary to assess your candidacy (principally your name, contact details, CV, and application materials). Items such as immigration and right to work documentation are collected only if and when an offer of employment is made.

Immigration & right-to-work documentation

Citizenship details, national identification number, and other documents required to demonstrate your right to work in the relevant country.

Application & recruitment information

Information contained in your application, covering letter and CV/resume (including name, personal address, telephone, email address, date of birth, age, government ID, citizenship status, academic record, qualifications, skills, accreditations and career history); interview and assessment notes; suitability assessments; references received; and background verification results.

AI-assisted recruitment tools

Where Dataiku uses AI-assisted tools to support the recruitment process (for example, tools that generate transcripts or summaries of interview interactions), the outputs of those tools form part of your recruitment record. Any such tools involve human oversight, and no decision regarding your application is made solely on the basis of an automated output.

Photo & miscellaneous

Your photo, where provided as part of your application, and any other information that you submit to us in the course of your application or interactions with us. We do not request photographs as part of the recruitment process. Where you choose to include a photo in your application materials, it will not be used as a factor in any recruitment decision.

3. How is your personal information collected?

We will receive most of this personal information directly from you through the application and recruitment process. We may also receive information from third parties, such as recruitment agencies, social media or online searches (including LinkedIn), background check providers, former employers, training providers, or public agencies. We may collect this information in a variety of ways, including through application forms, CVs/resumes, from identity documents, from correspondence with you, or through interviews, meetings or assessments.

4. How and why we use your personal information

We may use your personal information for the following purposes:

• We collect and use your contact details and application materials to assess your suitability for the role you have applied for and to communicate with you throughout the recruitment process, including through our applicant tracking system.

• We review your CV or résumé, cover letter, and any information provided to evaluate your skills and experience against the requirements of the position.

• If you are asked to complete an assessment or provide a presentation as part of the process, we use that information to further assess your fit for the role.

• If you progress in the recruitment process, we may use your information to conduct background checks, right-to-work verification, reference checks, and, for certain roles, global watchlist screening, to the extent permitted by applicable law.

• We may use your information to make reasonable adjustments to the recruitment process where you have indicated a disability or health condition.

• If your application is successful, your personal information will be transferred to your employee file and used in connection with your employment.

• If your application is not successful, and only where you have given consent, we may retain your information for a period after the close of the recruitment process in order to contact you about future roles that may be of interest, or to respond to any claims arising from the process.

• We may process your personal information to comply with our legal, regulatory, and corporate governance requirements, including responding to requests from public authorities.

• We may also use your information to analyse and improve our recruitment process.

We will only use your personal information for the purposes set out above unless we reasonably consider that a new use is compatible with the original purpose and we notify you accordingly. We process your personal data on one or more of the following legal bases:

Consent

In certain cases, we will ask for your consent before processing your personal information, where we are not otherwise able to rely on another legal basis or where applicable law specifically requires it. You may withdraw your consent at any time by contacting [email protected].

Performance of a contract

We process your personal data where necessary to take steps, at your request, prior to entering into an employment relationship, including to evaluate your application, make an offer, and complete a contract of employment.

Legitimate interests may apply for processings that go beyond your initial application, such as proactive sourcing, personality assessments, or evaluation tools not initiated at your request.

Legitimate interests

We process your personal data where we have a legitimate interest in doing so that is not overridden by your interests or fundamental rights, including to conduct our recruitment process efficiently, maintain adequate records, operate centralised HR and applicant tracking systems, and defend against potential claims arising from the process.

Legal obligation

We process your personal data where we are required to do so by law, including to verify your right to work.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising purposes.

5. Why we collect and use sensitive personal data

Sensitive personal data, so called "special categories" of personal data, require higher levels of protection. We need to have further justification for collecting, storing and using this, provided this is allowed by the applicable country and we collect it following one of the circumstances listed below. Special category data is personal data relating to: racial or ethnic origins; political opinions; religious and philosophical beliefs; trade union membership; genetic data; biometric data; health data; sex life or sexual orientation.

We may process special categories of personal data in the following general circumstances:

• In limited circumstances, with your explicit consent;

• Where necessary to carry out our legal obligations or exercise rights conferred on us by law;

• To make reasonable adjustments to the recruitment process on grounds of disability or health, where you have provided relevant information;

• For the purposes of equal opportunities monitoring, where required or permitted by law; or

• In connection with legal claims.

If you do not provide this information, we will be unable to process your application. Information collected at the offer stage is required to formalise your employment contract and comply with legal obligations; failure to provide it will prevent us from completing the hiring process.

6. How we share your personal information

We may share your personal data with third parties, including third-party service providers and other entities within the Dataiku group. We require all third parties to respect the security of your data and to treat it in accordance with applicable law.

Within the Dataiku group

Your personal information may be shared with other Dataiku group entities where necessary for the administration of the recruitment process, for internal HR and systems management, or for legal or compliance purposes. Access is limited to those who need the information, including staff in HR, talent acquisition, legal, information technology, and finance.

With third-party service providers

We will share your personal data with third parties where required by law or where necessary to administer the recruitment process. Categories of recipients include:

• HR and talent acquisition services and software, including applicant tracking system providers and external recruitment advisors (such as GreenHouse, Workday);

• Background check and verification providers (such as Checkr);

• Cloud storage, IT systems and cyber security providers;

• Occupational health assessment providers and medical professionals;

• Immigration and right-to-work compliance providers; and

• Police and immigration authorities where required by law.

In other circumstances

We may also disclose your personal information:

• In connection with a sale, merger or acquisition of Dataiku or its assets;

• Where required by law, regulation, or a request from government or law enforcement;

• To enforce our legal rights, respond to claims, or protect the safety of any person; or

• To protect the rights, property or safety of the Company or others.

We will not share your personal information for purposes beyond those described in this Notice without notifying you and, where required, obtaining your consent.

7. International transfers of personal data

Wherever we process your personal data, we take appropriate steps to ensure it is protected in accordance with this Notice and applicable law. For transfers of personal data from the EEA or the UK to countries that do not benefit from an adequacy decision, we rely on the Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914). Transfers between Dataiku group entities are governed by our Intragroup Data Transfer Agreement, which incorporates those same clauses. Where necessary, we implement supplementary measures to ensure your data receives an adequate level of protection.

8. Retention of personal information

We retain recruitment data for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, and to establish, exercise or defend legal claims.

Indicative retention periods

• Unsuccessful candidate records are generally retained for between 3 months and 2 years following the close of the recruitment process, depending on the applicable jurisdiction and whether you have provided consent to extended retention;

• Background check and criminal conviction data is destroyed promptly after verification.

We retain personal information following recruitment exercises to demonstrate, where required, that candidates were not discriminated against on prohibited grounds and that the recruitment process was conducted fairly and transparently.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once retention is no longer necessary, we will securely destroy your personal data in accordance with applicable law.

9. Your rights

You have rights in relation to your personal information. The specific rights available to you depend on where you are located and the applicable law. These include:

• The right to access a copy of personal information we hold about you;

• The right to rectification of inaccurate or incomplete data;

• The right to erasure, where data is no longer necessary for the purposes for which it was collected or where you have withdrawn consent;

• The right to restriction of processing in certain circumstances;

• The right to data portability;

• The right to object to processing based on legitimate interests; and

• The right to withdraw your consent, noting that Dataiku will stop the relevant processing unless we have another lawful basis to continue.

To exercise any of these rights, our Data Protection Officer can be reached at [email protected], 201-203 Rue de Bercy, 75012 Paris, France. We will respond to your request within one month. This period may be extended by a further two months where necessary, taking into account the complexity of your request, in which case we will inform you of the extension and the reasons for it within the initial one-month period.

If you are not satisfied with our response, a list of EEA data protection authorities is available here, and the contact details for the UK Information Commissioner's Office is available here.

10. Security

Dataiku is committed to protecting personal information from loss, misuse, disclosure, alteration, unauthorised access and destruction and takes all appropriate precautions to safeguard the confidentiality of personal information. Although we make every effort to protect the personal information which you provide to us, the transmission of information over the internet is not completely secure. As such, you acknowledge that we cannot guarantee the security of your personal information transmitted to us over the internet and that any such transmission is at your own risk. Once we have received your personal information, we will use strict procedures and security features to prevent unauthorized access.

Where we have given you (or where you have chosen) a password which enables you to access any account with us, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

11. Automated decision-making

We do not make hiring decisions based solely on automated processing. In some instances, we may use AI-assisted tools to support the recruitment process, for example, tools that generate transcripts or summaries of interview interactions, for the sole purpose of supporting our recruiting teams. A human reviewer is always involved before any decision is made regarding your application.

The AI-assisted tools currently used in our recruitment process are limited to generating transcripts and summaries of interview interactions to assist our recruiting teams in documenting and comparing candidate responses. These tools process the audio or video content of your interviews and produce text-based outputs. The outputs are reviewed by a recruiter and serve as a supplementary reference alongside the recruiter's own notes and assessment. They do not produce scores, rankings, or recommendations, and they do not autonomously filter or exclude any candidate. You are informed of the use of these tools prior to any interview in which they are deployed, and you may request access to this data in accordance with Section 9 of this Policy.

12. Changes to this notice

This Notice does not form part of any offer of employment or engagement and we may update it from time to time. We will notify you of any significant changes. The current version is always available at [email protected] on request.

Annex — Processing activities summary

Questions about this Notice?

Contact our Privacy team: [email protected]