Candidate Privacy Notice

1. About this notice

This Candidate Privacy Notice explains how H2O.ai, Inc. and its subsidiaries ("H2O.ai", "we", "us") collects, uses, shares, and protects personal information about candidates during our recruitment andhiring process. It applies to applicants and prospective candidates worldwide who apply for, or areconsidered for, a role with us, however you come into contact with us (for example, by applying directly, through a recruiter, or via a referral).

Region-specific sections at the end of this notice provide additional information and rights for candidates in California, the EU/EEA and UK, and Australia. Where a region-specific section conflicts with the general sections, the region-specific section governs for candidates in that location.

2. Who we are

H2O.ai is the organization responsible for your personal information in connection with our recruitment process. For the purposes of EU/UK data protection law, the data controller is H2O.ai. If you have any questions about this notice or how we handle your information, contact us using the details in Section 16.

3. The information we collect

Depending on the role and how far you progress, we may collect the following categories of personal information:

Identifiers and contact details: name, email address, telephone number, postal address, and similar identifiers.
Recruitment and professional information: resume/CV, cover letter, employment and education history, qualifications, skills, references, and information from interviews and assessments.
Work authorization and immigration information: your right to work, visa or work-authorization status, and, where sponsorship is relevant, the additional details described in Section 6.
Information you choose to provide: anything else you include in your application or share with us during the process.
Information from third parties: details from recruiters, referees, background-check providers (where permitted and with notice/consent), and publicly available professional sources.
Technical and usage information: where you apply through our careers site or an applicant tracking system, limited technical data such as IP address and information about how you use the site.

We collect sensitive information (including, in some jurisdictions, citizenship or immigration status, and information that may reveal racial or ethnic origin such as country of birth) only where it is reasonably necessary for, and relevant to, the recruitment and sponsorship process, and in accordance with applicable law. See Sections 6 and 12-14.

4. How we collect your information

We collect personal information directly from you (for example, through your application, the sponsorship questionnaire, interviews, and correspondence), and, where applicable, from recruiters,referees you nominate, background-check providers, and publicly available sources.

5. Why we use your information and our legal grounds

We use your personal information to: assess your suitability for the role; communicate with you about your application; arrange and conduct interviews and assessments; verify your information, including your right to work and work-authorization status; assess and, where applicable, pursue immigration sponsorship options; make hiring decisions and, if successful, prepare to onboard you; maintain records of our recruitment process; and comply with our legal obligations.

Where data protection law requires us to identify a legal ground for processing (for example, in the EU/EEA and UK), we generally rely on:

Our legitimate interests in recruiting and assessing candidates and running an effective hiring process, balanced against your rights;
Taking steps at your request prior to entering into a contract of employment or engagement;
Compliance with a legal obligation, such as immigration, right-to-work, and equal-opportunity requirements; and
Your consent, where we ask for it (for example, before collecting certain sensitive information). Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

6. Immigration, work authorization, and sponsorship information

If you indicate that you may need immigration or work-authorization support, we will ask you to complete a sponsorship questionnaire. This questionnaire collects information about your immigration status and history and may include sensitive information such as your country of birth and details of dependents.

We collect and use this information solely to assess your work-authorization needs and possible sponsorship options and to comply with applicable immigration law. We share your responses with our external immigration counsel, Envoy Global, and with the H2O.ai staff supporting the review, and we do not use this information for any other purpose. Completing the questionnaire is voluntary, but we may be unable to assess sponsorship options without it. Where required by law, we will ask for your consent before collecting this information.

H2O.ai personnel involved in the recruitment, hiring, and (where relevant) sponsorshipprocess;
Our external immigration counsel, Envoy Global, in connection with sponsorship matters;
Service providers who support our recruitment process under contract, such as our applicant tracking and form-hosting providers (for example, the platform used to host the sponsorship questionnaire) and background-check providers;
Government authorities and regulators where required by law (for example, immigration authorities); and
Professional advisors and, in the context of a corporate transaction, prospective buyers, in each case subject to appropriate confidentiality protections.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

8. International transfers of your information

As a global organization, we may transfer your personal information to, and store it in, countries other than the one in which you are located, including the United States. Where we transfer personal information across borders in a way that triggers legal requirements, we put appropriate safeguards in place, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism.

9. How long we keep your information

We keep candidate personal information for as long as necessary for the purposes described in this notice. If your application is unsuccessful, we generally retain your information for 12 months so we can consider you for future roles and to meet our legal and recordkeeping obligations, after which we delete or anonymize it, unless a longer period is required by law. If you are hired, relevant information will be transferred to your employee file and retained in accordance with our employee data policies.

10. How we protect your information

We maintain appropriate technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. Access to sponsorship and immigration information is limited to those who need it for the purposes described above.

11. Your privacy rights

Depending on where you live, you may have rights over your personal information, such as the right to access, correct, or delete it, and to object to or restrict certain processing. The region-specific sections below describe these rights in more detail. To exercise any right, contact us using the details in Section 16. We will not discriminate or retaliate against you for exercising your privacy rights.

12. Additional information for candidates in California (CPRA/CCPA)

This section applies to candidates who are California residents and supplements the information above. Under the California Consumer Privacy Act, as amended (CCPA/CPRA), we provide this notice at or before the point at which we collect your personal information.

Categories of personal information we collect include identifiers; professional or employment-related information; education information; and, where relevant, characteristics protected under California or federal law. We also collect categories of "sensitive personal information," which can include citizenship or immigration status (treated as sensitive personal information under California law) and,where provided, other sensitive details.

We use personal and sensitive personal information for the recruitment and sponsorship purposes described in Section 5 and to comply with law. We use sensitive personal information only for purposes permitted by the CCPA/CPRA and do not use it to infer characteristics about you for other purposes. We do not sell or share (for cross-context behavioral advertising) personal or sensitive personal information.

Subject to certain exceptions, California candidates have the right to know/access the personalinformation we collect, to request deletion, to request correction, and to limit the use and disclosureof sensitive personal information. To exercise these rights, contact us using the details in Section 16. We will not discriminate against you for exercising your rights.

This section applies to candidates in the EU/EEA and the UK and supplements the information above. The data controller and our legal grounds for processing are described in Sections 2 and 5. We provide this notice at the time we collect your information, in accordance with Articles 13 and 14 of the GDPR.

Subject to applicable conditions, you have the right to: access your personal information; have it corrected or erased; restrict or object to its processing; data portability; and, where processing is based on consent, withdraw that consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority.

We do not make decisions producing legal or similarly significant effects about candidates based solely on automated processing. Our recruitment process uses JazzHR’s TalentFit feature, which applies automated processing to score and rank candidates’ resumes against the job description. This scoring is used to assist recruiters in prioritizing applications; it does not make hiring decisions. A human recruiter always reviews candidate applications and makes the final decision on advancement or rejection. Our privacy contact can be reached at privacy@h2o.ai.

14. Additional information for candidates in Australia

This section applies to candidates in Australia and supplements the information above. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect your personal information for the recruitment and sponsorship purposes described in this notice; where it is not practicable to notify you at the time of collection, we will do so as soon as practicable afterward.

We collect "sensitive information" (which can include information such as country of birth that may reveal racial or ethnic origin) only with your consent and where it is reasonably necessary for our recruitment and sponsorship activities. Your information may be disclosed to overseas recipients, including in the United States, as described in Section 8. You may request access to, and correction of, your personal information by contacting us using the details in Section 16. If you have a privacy concern or complaint, you may contact us and, if unresolved, the Office of the Australian Information Commissioner (OAIC).

15. Changes to this notice

We may update this notice from time to time. We will post the updated version with a revised "Last updated" date and, where appropriate, notify you of material changes.

16. How to contact us

If you have questions about this notice, wish to exercise your privacy rights, or want more information about our data-transfer safeguards, contact us at privacy@h2o.ai.