Job Applicant Privacy Notice

Supermassive Games Limited (“we”, “us” or “our” in this notice) collect and process personal information relating to you as a job applicant.

When we collect and use information about you as your potential employer, we will likely do so as a ‘data controller’. This means we are responsible for deciding the purposes and means for which the personal information we hold about you is being processed.

We will comply with all applicable data protection laws, including the General Data Protection Regulation 2016/679.

1. What is the purpose of this document?

This Job Applicant Privacy Notice sets out the types of data we collect and hold on you as a job applicant. It also sets out how we use that information, how long we keep it for and other relevant information about your data.

If you have any questions or comments about this privacy notice, please contact HR at hr@supermassivegames.com.

2. The kind of information we hold about you.

We may collect, store, and use the following categories of personal information about you:

• Your personal details including your name, postal address, email address and phone numbers

• Your photograph

• Information included on your CV including education history, employment history and references

• Documentation relating to your right to work in the UK

• Information from interviews (such as interview notes or standard candidate assessment forms) or phone-screenings preceding employment offer

• Information included in your job application, (such as salary information, notice period and work portfolio)

• Whether or not you require any reasonable adjustments related to a disability

In relation to your personal data, we will:

• process it fairly, lawfully and in a clear, transparent way;

• collect your data only for reasons that we find proper for the course of your employment in ways that have been explained to you;

• only use it in the way that we have told you about;

• ensure it is correct and up to date;

• keep your data for only as long as we need it;

• process it in a way that ensures it will not be used for anything that you are not aware of or have consented to (as appropriate), lost or destroyed.

3. How is your personal information collected?

We collect data about you in a variety of ways, including the information you would normally provide in a CV or a job application cover letter, or within notes made by our recruitment team during the hiring process.

In some cases, we will collect data about you from third parties, such as employment agencies, LinkedIn (or other social or job search platforms) and former employers when gathering references.

Personal data is kept in personnel files or within the Company’s HR and IT systems, such as our applicant tracking system (Workable) and Outlook.

One of the reasons for processing your data is to allow us to carry out an effective recruitment process and assess your suitability for employment. Whilst you are under no obligation to provide us with your data, we may not be able to process, or continue with (as appropriate), your application if we do not have your consent.

4. How we will use information about you and on what basis

The law on data protection allows us to process your data for certain reasons only:

• in order to perform the employment contract that we may be party to

• in order to carry out legally required duties

• in order for us to carry out our legitimate interests

• to protect your interests, and

• where something is done in the public interest.

All the processing carried out by us falls into one of the permitted reasons. Generally, we will rely on our legal duties and legitimate interests to process your data.

We need to collect your data to ensure we are complying with legal requirements such as:

• carrying out checks in relation to your right to work in the UK and

• making reasonable adjustments for disabled employees.

We also collect data so that we can carry out activities which are in the legitimate interests of the Company. We have set these out below:

• making decisions about who to offer employment to

• making decisions about salary and other benefits

• assessing training needs

• dealing with legal claims that might be made against us

5. How we use ‘special categories’ of personal information

Given the nature of the data, we will only process “special categories” of personal information if it is appropriate and where we are legally able to do so. Under certain circumstances, we may use such personal information in accordance with our legal obligations, or to exercise specific rights in the field of employment law.

Special categories of data are those relating to your:

• health/disabilities

• sexual orientation

• race

• ethnic origin

• religion

We may use your special category data for the purposes of equal opportunities monitoring.

6. Use of CCTV

CCTV operates within each of our office buildings on 24/7 basis, monitoring entry and exit doors and communal building areas, as displayed by appropriate signage.

Captured data is only stored for a maximum of 30 days and is only viewed by our third-party provider in the event of an alarm being triggered; alarms are only armed out-of-hours and not during the working day.

Where you attend our office for an in-person meeting or interview during the recruitment process, such CCTV footage may inadvertently reveal “special categories" of data, such as information about your health or racial or ethnic origin.

The use of CCTV footage is strictly limited to the purpose of the prevention and detection of unlawful acts.

7. Information about Criminal Convictions

We do not envisage that we will hold information about criminal convictions. If we do, we will only do so because there is a legal basis for it.

8. Data sharing

Your data will be shared with individuals in the Company where it is necessary for them to effectively undertake their duties within the recruitment process. This includes, for example, the HR and Recruitment department, those in the department where the vacancy is (who are responsible for screening your application and interviewing you) and the IT department where you may require access to our systems (e.g., to undertake any assessments requiring IT equipment).

In some cases, we will collect data about you from third parties, such as employment agencies. We may also share personal information with third party service providers insofar as it is reasonably necessary for the purposes set out in this privacy notice. We will only permit them to process your personal data for specified purposes.

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. The following activities are carried out by third party service providers:

Workable Applicant tracking and processing job applications

DocuSign Issuing relevant documents for e-signature

Blake Morgan Professional Advisors regarding immigration and right to work

Regus Out-of-hours CCTV recording in communal building areas at Farnham Road office

JLL Out-of-hours CCTV recording in communal building areas at Woodbridge Road office

Evolution Out-of-hours CCTV recording within office areas at Ranger House and Woodbridge Road office

Cushman & Wakefield Out-of-hours CCTV recording in communal building areas at Ranger House office

9. Data security

We will take all reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.

Please be aware that, while we place a high priority on the security of all information that we hold and process as an employer and we endeavour to provide robust, commercially reasonable security at all times, no security system can prevent every security breach.

10. Data Retention

In line with data protection principles, we only keep your data for as long as we need it, and this will depend on whether you are successful in obtaining employment with us.

If your application is successful, your data will be kept and transferred to the systems we administer for employees. We have a separate privacy notice for employees, which will be provided to you.

If your application is not successful, assuming we have sought your consent to do so, we will retain your data for 24 months once the recruitment exercise ends, after which it will be automatically deleted.

11. Your rights in connection with personal information

Under certain circumstances you have the following rights over the way we process personal information relating to you. We aim to comply without undue delay, and within one month at the latest:

• the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice

• the right of access. You have the right to access the data that we hold on you. To do so, you should make a subject access request

• the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it

• the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it

• the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct

• the right to portability. You may transfer the data that we hold on you for your own purposes

• the right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests

• the right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legal or legitimate reason for doing so.

If you wish to exercise any of the rights explained above, please send your request to Jonathan Amor, Operations Director, at gdpr@supermassivegames.com.

12. Making a complaint

The supervisory authority in the UK for data protection matters is the Information Commissioner’s Office (ICO). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the ICO.

13. Changes to this Privacy Notice and applicability of other policies

We reserve the right to update this Privacy Notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information. This notice does not form part of any contract of employment or other contract to provide services.

If you are unsure of how, or if this privacy notice applies to you, please contact HR on hr@supermassivegames.com.