Job Applicant Privacy Notice

Last updated: [TBD] · This is a working draft pending legal review.

This notice explains how Coded B.V. ("Coded", "we", "us") handles the personal data of people who apply for a job or otherwise express interest in working with us — through our Careers pages, by email, through a recruiter, or any other channel. It describes what we collect, why, on what legal basis, how long we keep it, who we share it with, and the rights you have over your data.

Coded B.V. is a private limited company (besloten vennootschap) registered in the Netherlands, with its registered office at De Taling 15, 2761 SL Zevenhuizen, The Netherlands, Dutch Chamber of Commerce (KvK) number 42027097 and VAT number NL869368795B01. Coded B.V. is a subsidiary of Coded Holding B.V. Coded operates internationally; the Netherlands is our home market and the place we are established. For the purposes of this notice, Coded B.V. is the controller of your personal data — meaning we decide why and how it is processed.

This notice covers applicants worldwide. Where the mandatory law of your own country, state, or region gives you stronger rights or protections, those continue to apply to you in addition to what is described here.

1. Who this notice applies to

This notice applies to you if you:

• apply for an advertised role at Coded;
• submit a speculative or open application;
• are contacted by us, or by a recruiter acting for us, about a possible role;
• ask to be considered for future opportunities (our "talent pool"); or
• are referred to us by a current employee or contact.

It does not cover personal data we process about you once you become an employee or contractor — that is covered by a separate staff privacy notice provided at the point of engagement.

2. The personal data we collect

The data we hold about you comes from you directly, from people you authorise (such as referees), and from sources you have made available for recruitment (such as a professional networking profile you have published). Depending on the role and how far your application progresses, we may collect:

2.1 Information you provide

• Identity and contact details — your name, email address, phone number, postal or city location, and links you choose to share (for example a portfolio, professional profile, or code repository).
• Application materials — your CV or résumé, cover letter, and answers to any application questions.
• Career and qualification information — your work history, education, skills, certifications, language abilities, and similar professional background.
• Assessment information — notes, scores, recordings (where you are told in advance and where lawful), and outcomes from interviews, work-sample tasks, or technical exercises.
• Right-to-work and onboarding information — collected only for candidates we intend to make an offer to, and only to the extent we are required to verify eligibility to work in the relevant location.
• Anything else you choose to tell us during the process.

2.2 Information from others

• References — feedback from referees you nominate, collected with your knowledge, typically at a late stage.
• Background and verification checks — where a role requires them and where lawful, carried out with prior notice and, where required, your consent.
• Recruiter and referral information — details passed to us by a recruitment agency you have engaged with, or by a person who refers you.

2.3 Special categories and sensitive data

We do not ask for special-category data (such as health, racial or ethnic origin, religious beliefs, or trade-union membership) as part of assessing your application. Please do not include it in your application materials. Where we are legally required to process limited sensitive information — for example to provide reasonable accommodations during the process, or to meet an equal-opportunity reporting obligation — we will tell you why, keep it separate, and rely on an appropriate legal basis (such as your explicit consent or a specific legal obligation).

3. Why we use your data and our legal basis

We use applicant data only for recruitment-related purposes. The table below sets out each purpose and the legal basis we rely on under the EU/UK GDPR. Where you are in a jurisdiction that uses different terminology (for example US state privacy laws), the equivalent lawful ground applies, and the purpose remains the same.

Where we rely on legitimate interest, we have weighed our interest in recruiting effectively against your rights and freedoms, and limited what we collect to what is reasonably needed. You can ask us about this assessment using the contact details below.

Where we rely on consent — principally for the talent pool and for certain checks — you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

4. How long we keep your data

We keep applicant data only for as long as it serves the purpose it was collected for, then delete or anonymise it.

• Unsuccessful applicants — we retain your application and assessment data for a limited period after the decision (target: 6 months, and no longer than 12 months unless a longer period is required), so we can reconsider you for a closely related role, respond to questions, and defend against any challenge to the process.
• Successful applicants — relevant data transfers into your employee or contractor file and is retained under the separate staff privacy notice and applicable employment-record retention rules.
• Talent pool — where you have given consent, we keep your details until you ask us to remove them or until we re-confirm your interest at a defined interval (target: re-confirm every 12 months), whichever is sooner.
• Right-to-work and verification records — retained only as long as the relevant law requires.

Where a legal obligation or a live or anticipated dispute requires us to keep data longer, we will retain only what is necessary for that purpose.

5. Talent pool

If you ask — or agree when we ask you — to be kept on file for future opportunities, we add your details to our talent pool on the basis of your consent. This means we may contact you about roles that match your background.

You can leave the talent pool at any time, with no effect on any current or future application, by emailing us at the address in the Contact section or using any unsubscribe link we provide. We will also periodically re-confirm that you still wish to remain, and remove you if we do not hear back.

6. Where your data is processed and stored

Coded hosts its core systems in the European Union (Frankfurt, Germany). This is a deliberate privacy and security design choice. Because Coded operates internationally, some of the people involved in recruiting — for example interviewers, hiring managers, or service providers — may be located outside the country where you applied, including outside the European Economic Area.

Where applicant data is transferred across borders, we put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses, an adequacy decision where one exists, or another lawful transfer mechanism recognised in the relevant jurisdiction. You can ask us for more detail about the safeguards that apply to you.

7. Who we share your data with

We do not sell applicant data, and we do not share it for cross-context behavioural advertising. We share it only with:

• People inside Coded involved in the relevant hiring decision — recruiters, interviewers, hiring managers, and the people who support them.
• Service providers (processors) acting on our instructions, such as our applicant-tracking and scheduling tools, assessment platforms, and IT and communications providers. These providers may process data only for us, under a written data-processing agreement, and not for their own purposes.
• Recruitment agencies you have engaged with, or that we have engaged to source candidates, where relevant to your application.
• Background-check and reference providers, where a check is part of the process and lawful, with prior notice.
• Professional advisers, auditors, or authorities, where we are legally required to disclose, or to establish or defend a legal claim.

We do not use your applicant data to make solely automated decisions that produce legal or similarly significant effects about you without a lawful basis and appropriate safeguards. Where any automated tooling is used to help screen applications, a human reviews the outcome before a decision is made.

8. Your rights

You have rights over your personal data. We honour these rights for all applicants. The exact name and scope of a right depends on where you are, but in general you can ask us to:

• Access the personal data we hold about you and receive a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data, where there is no overriding reason for us to keep it.
• Restrict or object to certain processing, including processing based on our legitimate interests.
• Receive and reuse (port) data you provided to us, in a portable format, where applicable.
• Withdraw consent at any time, where we rely on consent (such as the talent pool), without affecting prior processing.

For applicants covered by US state privacy laws (including California's CCPA/CPRA and comparable laws in other states), you additionally have the right to know what we collect, to delete, to correct, and to opt out of any "sale" or "sharing" of personal data — though, as noted, we do not sell or share applicant data for behavioural advertising. We will not discriminate or retaliate against you for exercising any privacy right.

To exercise a right, contact us using the details in the Contact section. We will verify your identity before acting and respond within the timeframe required by the law that applies to you. Using these rights is free; we may charge a reasonable fee or decline only where a request is manifestly unfounded or excessive, and we will explain if so.

If you believe we have mishandled your data, you can also complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may instead contact the supervisory authority or regulator in your own country or state.

9. How we protect your data

We apply privacy-by-design principles to recruitment: we collect the minimum necessary, restrict access to those who need it, and use technical and organisational safeguards appropriate to the sensitivity of the data, including access controls, encryption in transit, and EU-based hosting of core systems. No system is perfectly secure, but we work to keep applicant data protected throughout the process and to delete it promptly when it is no longer needed.

10. Changes to this notice

We may update this notice as our recruitment practices, tools, or legal obligations change. The current version is always available on our Careers pages, with the "last updated" date shown above. Material changes affecting applicants will be reflected here before they take effect.

Contact

For any question about this notice, or to exercise a privacy right, contact:

• Privacy / data protection: privacy@coded.eu
• General legal enquiries: legal@coded.eu
• Security concerns: security@coded.co
• Post: Coded B.V., De Taling 15, 2761 SL Zevenhuizen, The Netherlands

If we have appointed a Data Protection Officer or an EU/UK representative, their details will be added here.

This notice takes effect on 11 June 2026.