Amagi Recruitment Privacy Notice for Job Applicants/Candidates

This Privacy Notice on the processing of personal data (hereinafter: "Privacy Notice") regulates the method of data collection, data processing, data collection purposes and the rights of candidates for employment for positions within Amagi (hereinafter: “you” or “data subject” or “candidate”) in relation to the data collected and processed by Amagi Media Labs Limited and its affiliates and subsidiaries (collectively, “Amagi”) during the employment candidate selection process, with the aim of the Privacy Notice being to inform data subjects in a clear and transparent manner how we collect, use, process, disclose, and safeguard your personal information; the processing operations of your personal data and your rights, all in accordance with all applicable data protection legislation. 

Your interaction with Amagi’s website is also governed by Amagi’s Website Privacy Policy, provided that in the event of a conflict between Amagi’s Website Privacy Policy and this Privacy Notice, this Privacy Notice shall prevail. We may provide you with additional notices about our data collection practices that are covered by other laws (e.g., if we conduct a background check).

Amagi may modify or update this Privacy Notice from time to time, notably in the event that material changes are made to applicable data protection laws (Data Protection Laws), or any other applicable data protection legislation is introduced. Any such modification shall become effective as of the date mentioned in the ‘Last Updated’ heading. We recommend that you check this Privacy Notice periodically to appraise yourself of any such revisions. We may also notify you in other ways from time to time about the processing of your Personal Data.

United States Residents who live in California, Colorado, and other U.S. states in which an applicable privacy law is in effect: The US Addendum below also applies to employment candidates located in these states.

DATA CONTROLLER

In terms of personal data protection, the Data Controller is Amagi Media Labs Limited, Raj Alkaa Park, Sy. No. 29/3 & 32/2, 4th floor, Kalena Agrahara Village, Begur Hobli, Bengaluru, Karnataka 560076, India, and its affiliates and subsidiaries (hereinafter: Amagi or Data Controller). Amagi is thus responsible for deciding the purposes and the means regarding the processing of your Information.

DATA PROTECTION OFFICER CONTACT INFORMATION: 

Name: Venkatesha KS

e-mail: venkatesha.ks@amagi.com

WHAT IS PERSONAL DATA? WHAT IS PERSONAL INFORMATION?

Under the General Data Protection Regulation - Regulation (EU) 2016/679 (GDPR), the UK Data Protection Act 2018 (DPA 2018), and the Brazilian General Data Protection Law (LGPD), 'personal data' is defined as any information that relates to an identified or identifiable individual. Under the Digital Personal Data Protection Act, 2023 (DPDPA) in India, ‘personal data’ is broadly defined as any data about an individual who is identifiable.

Under applicable privacy laws in the United States (including privacy laws in effect in California, Colorado, and other U.S. states in which an applicable privacy law is in effect (as of the date such law takes effect) (collectively, State Privacy Laws), subject to certain exceptions, "personal information" is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular resident or household in the applicable state.

This Privacy Notice refers to your personal data as the combination of the terms "personal data" and "personal information."

Among the Personal Data that may be processed by Amagi, there is a set of information which may be considered as belonging to ‘special categories of personal data’ (which may also be referred to as ‘sensitive personal information’ or ‘sensitive data’) under applicable laws. Such sensitive data covers information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, disability status, or trade union membership, genetic data, biometric data, data concerning health, or data concerning sex life or sexual orientation.

WHAT CATEGORIES OF PERSONAL DATA DO WE COLLECT?

Identification and contact data	First name, last name, phone number, home address, email address, IP address, activity logs, etc.
Education and Professional Information:	Information provided by the candidate in the candidate’s CV or resumé, Education information, and professional or employment-related history information, such as qualifications, experience, information relating to a candidate’s skills, etc.
Protected Classifications or Sensitive Personal Information:	Some CVs or resumés may include optional sensitive data. We recommend that you avoid including sensitive personal data in your resumes or application materials unless it is specifically relevant to the role or required by applicable law.
Other data:	Data voluntarily submitted by the candidate when applying for a job and during oral and written communication.

The Personal Data we collect is processed solely for recruitment-related purposes, including assessing your suitability for the role, conducting interviews, verifying information, and communicating with you during the recruitment process. Your Personal Data will only be processed to the extent necessary to support a fair and efficient recruitment process. If you are within an age constituting a minor under applicable law, please do not submit your Personal Data to us. In certain cases, it is possible to achieve the purpose of processing using a smaller scope of data than previously described, since we collect only the data necessary for achieving a specific purpose.

Providing Personal Data during the recruitment process is voluntary. However, certain information is necessary for the proper evaluation and processing of your application. If you choose not to provide the requested information, we may be unable to assess your candidacy or proceed with your application. We collect only the data that is relevant and proportionate to the recruitment process, and all information is handled in accordance with applicable Data Protection Laws.

We collect Personal Data primarily directly from you. We may receive your personal information indirectly from sources such as professional networks where you have set up a publicly available profile, from recruiters or third parties that you have authorized to share your information with us, from third-party background verification service providers, and/or publicly available sources, including any online service provider or recruitment platforms where you have submitted your profile in connection with application or candidature for employment with us (“Online Platform Partners”). Information that we receive from other sources may be combined with the Personal Data that you provide to us.

FOR WHAT PURPOSES AND ON WHAT BASIS DO WE PROCESS YOUR PERSONAL DATA?

We collect and process your Personal Data for the following purposes:

• selection process and selection of candidates 
  • Amagi processes the candidate's Personal Data in cases where it receives an application for an employment position. Amagi processes candidates' Personal Data to verify that they meet all the requirements for the position they have applied for. For this purpose, the candidate's identification data, qualification and work experience data, background check information, and other data provided by the candidate (or by third parties as set out in Section 2 above) may be processed. Amagi processes the candidate's Personal Data because such processing is necessary to take steps at the candidate's request prior to entering into a potential contract.
• communication with candidates related to their application
  • Amagi also uses the candidates' Personal Data to communicate with candidates about the state of their application for the position and respond to candidates' inquiries. For this purpose, Amagi processes candidate identification data and their contact information. In this case, Amagi processes the candidate's Personal Data because such processing is necessary to take steps at the candidate's request prior to entering into a potential contract.
• for potential employment in the future of candidates who have not been selected
  • Amagi may retain the candidate's Personal Data collected during the application for potential future employment. Amagi performs this processing solely on the basis of the data subject's consent, which the data subject may withdraw at any time. Consent can be withdrawn by sending a notification to the e-mail address set out in Section 10 below.
• defense of legal claims, security, fraud prevention, and protecting rights
  • Amagi processes your Personal Data in order to protect and defend its rights and interests and those of third parties, including to manage and respond to legal claims or disputes, ensure security, prevent fraud, and to otherwise establish, defend or protect its rights or interests, or the rights, interests, health or safety of others, including in the context of anticipated or actual litigation with third parties whether in court proceedings, in administrative or non-contentious proceedings. Amagi performs this processing for the purposes of the legitimate interests pursued by the Data Controller.
• For the purpose of potential employment of the candidate
  • In the event that Amagi decides to hire the candidate, the Personal Data collected during the job application and recruitment process will be processed by Amagi in order to prepare and enter into an employment contract with the candidate. For this purpose, Amagi collects the candidate’s identification, contact information, and other relevant data to establish an employment relationship with Amagi. In this case, Amagi processes the candidate's personal data because it is necessary to enter into and perform an employment contract and to take appropriate steps at the candidate's request before entering into the contract.
• For the purpose of fulfilling Amagi’s legal obligations
  • Amagi may process candidates' personal data as necessary to comply with laws and other regulations, i.e., to meet Amagi's legal obligations as the data controller. These obligations may relate to anti-discrimination rules, priority employment rights for certain individuals, and similar requirements (for example, to comply with any applicable reporting obligations under Equal Employment Opportunity (“EEO”) laws). It is possible that, based on certain laws or regulations, Amagi may also be required to provide candidates’ Personal Data to other government and/or regulatory authorities (e.g., in the event of a subpoena or court order). In such cases, Amagi processes personal data because this processing is necessary to comply with its legal obligations.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

Amagi will retain the Personal Data only for as long as necessary to fulfil the purposes for which Amagi collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for Personal Data, Amagi considers the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of Personal Data, the purposes for which Amagi processes the Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements. 

If the candidate has given consent, the Personal Data of a candidate who has not been selected may be kept for a further period of 24 months from the date of completion of the job vacancy to which the candidate applied, for the purpose of potential employment of the candidate in the future.

If judicial, administrative, or non-judicial proceedings have been initiated, the Personal Data will be processed until the final conclusion of such proceedings or the achievement of the Data Controller’s legitimate interest in another way.

Upon expiry of the period necessary or prescribed for processing Personal Data, the Data Controller shall delete or destroy the Personal Data.

WHO HAS ACCESS TO YOUR PERSONAL DATA?

Access to your Personal Data is granted exclusively to the authorized persons of the Data Controller responsible for the collection, processing, and use of certain Personal Data within the scope of their workplace (hereinafter: "Authorized Persons"). We limit access to your Personal Data to those with a genuine business need to know it. Those processing your Personal Data are obligated to do so only in an authorized manner and are subject to a duty of confidentiality.

Amagi may also provide access to your Personal Data with affiliates and subsidiaries within the Amagi group of companies and third-party providers. "Third party providers" includes third-party service providers (including contractors and designated agents) who assist in the management of our recruitment activities. 

For example, we use MyNextHire (hereinafter: “MyNextHire”) as a service provider on our behalf to process your Personal Data. In the event that you apply for a vacancy posted by us on MyNextHire, these Privacy Notice provisions shall apply to the processing of your Personal Data. Amagi has entered into a data processing agreement with MyNextHire that ensures adequate protection of Personal Data. MyNextHire is only entitled to process your Personal Data in accordance with our instructions.

If we engage other natural or legal persons to process your Personal Data on our behalf and according to our instructions (data processors), we will do so based on a written contract and only with processors who provide sufficient contractual guarantees for the implementation of appropriate technical and organizational measures that meet the requirements of the General Data Protection Regulation and other applicable Data Protection Laws, to ensure the protection of your rights.

At your request, Amagi will provide information about the engaged processors involved in a particular data processing process, details of its processing activity, and its contact details.

Your Personal Data may also be provided to authorized recipients in the event of a merger, acquisition, asset sale or transfer, bankruptcy or reorganization or other similar business transactions involving Amagi for purposes of planning, due diligence and implementation of such transactions, based on a written contract and only with persons and entities who provide sufficient contractual guarantees for the implementation of appropriate technical and organizational measures that meet the requirements of the General Data Protection Regulation and other applicable Data Protection Laws to ensure the protection of your rights.

WHERE WILL YOUR PERSONAL DATA BE PROCESSED?

Where applicable, your Personal Data may be processed or stored in, or transferred to, countries outside the country in which you reside. Amagi ensures that such transfers will adhere to transfer mechanisms prescribed under applicable Data Protection Laws, implements reasonable technical and organizational measures during the transfer of the personal information, enters into appropriate data processing agreements with the recipients of such data to ensure that the terms of processing and the measures employed by the recipient are at least comparable to the terms set forth in this Privacy Notice, and ensures that such transfer is otherwise meets the requirements of applicable Data Protection Laws. In the case of transfers of data to a third country that is not the beneficiary of an adequacy decision by the European Commission, such transfers will only take place where we have implemented appropriate safeguards meeting the requirements of applicable Data Protection Laws, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission,
• Binding Corporate Rules (BCRs), or
• Other legally recognized transfer mechanisms.

Without limiting the generality of the foregoing, your Personal Data may be processed on the territory of the Republic of India in accordance with the measures stated in this Section 6. In the case of processing undertaken on our behalf by MyNextHire, since MyNextHire is based in India, an integral part of the data protection agreement signed between MyNextHire and Amagi are the SCCs. The data protection agreement and the SCCs are designed to ensure an adequate level of data protection set in the GDPR and other applicable Data Protection Laws.

You may obtain a copy of safeguards stated in this Item 6. of the Privacy notice or learn more about where they have been made available by contacting us at venkatesha.ks@amagi.com.

We ensure that all international data transfers comply with applicable Data Protection Laws and that your rights remain protected.

INFORMATION ABOUT THE USE OF AUTOMATED PROCESSING

We may use automated tools to assist our recruiting team in the initial stages of processing and evaluating job applications. These tools are designed solely to provide indicative assessments or match scores that help inform our team’s evaluation. Such processing may include the following, without limitation:

• Compare the information you supply with your application with the specific requirements and qualifications of the target role(s);

• Provide an overview to our recruiting team of your application details against the requirements of the job posting;

The tools do not make autonomous decisions to select or reject candidates, nor do they automatically filter out candidates based on responses to mandatory questions. All final decisions rest with human reviewers, ensuring contextualized assessment process.

HOW IS THE PERSONAL DATA OF CANDIDATES PROTECTED?

In order to protect your Personal Data, we take appropriate technical and organizational protection measures that comply with General Data Protection Regulation and all other applicable Data Protection Laws, including the implementation of technical and organizational measures to protect the Personal Data of data subjects from accidental or unlawful destruction, accidental loss, damage, alteration, unauthorized disclosure or access and from all forms of unlawful and/or excessive processing.

WHAT ARE THE RIGHTS OF THE DATA SUBJECT AND HOW CAN THEY BE EXERCISED?

• In accordance with the applicable Data Protection Laws in your jurisdiction, you may have the right to request one or more of the following: The right to access your Personal Data, i.e. the right to request confirmation of whether your Personal Data is being processed and if so, the right to request access to both information on the processing and a copy of the Personal Data being processed;
• The right to rectify or correct inaccurate and incomplete data;
• The right to erasure or deletion of Personal Data, in particular where such data are no longer necessary in relation to the purposes for which they were collected, if they have been unlawfully processed, if there is an obligation to erase in order to comply with legal obligations, or if you have withdrawn your consent;
• Right to restriction of the processing of Personal Data;
• The right to portability of Personal Data;
• Right to object to the processing of Personal Data.

WHO CAN YOU CONTACT WITH PERSONAL DATA PROTECTION INQUIRIES?

For any additional information, inquiries, requests or complaints related to the processing of your Personal Data, you can contact us via e-mail at: privacy@amagi.com.

We will respond to your request as soon as possible, and in any case within one month of receiving the request. That period may, where appropriate, be extended by a further two months, taking into account the complexity and number of requests with the Data Controller. In the event of an extension, we will be sure to inform you about the extension as well as the reasons for the extension.

RIGHT TO FILE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If you believe that the processing of your Personal Data is not in accordance with data protection regulations, you have the right to lodge a complaint with your local data protection supervisory authority.

Without prejudice to your right to lodge a complaint with a supervisory authority, we suggest that you first contact our Data Protection Officer to clarify any disputed issues.

ADDENDUM FOR US RESIDENTS OF CALIFORNIA, COLORADO, AND OTHER U.S. STATES IN WHICH AN APPLICABLE PRIVACY LAW IS IN EFFECT (AS OF THE DATE SUCH LAW TAKES EFFECT)

This Section describes our collection and use of certain Personal Information relating to candidates in the United States (“you” or “your”).  This Section is intended to satisfy our applicable notice requirements under State Privacy Laws, and any other federal or state regulations or laws applicable in the United States (together “Applicable U.S. Law”).

It is important that you read this Section, together with any other privacy notice we may provide on specific occasions when we collect or process Personal Information about you, so that you are aware of how and why we collect and use such information.

What kind of Personal Information is covered by this Section? 

This Section applies to Personal Information that we collect and use in order to manage potential candidates for employment. This Section applies to all Personal Information whether it is stored electronically, on paper or on other materials.

How do we define Personal Information?

“Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, or as otherwise defined by Applicable U.S. Law.

Categories of Personal Information Collected

Generally, we may collect the below categories of Personal Information about Candidates:  

Name, Contact Info, and other Identifiers. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, or other similar identifiers, and date of birth.

Protected Classifications. Characteristics of protected classifications under Applicable Law, such as gender, veteran status, disability, citizenship status, and military/veteran status.

Usage Data. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a candidate’s interaction with an internet requirement website, application, or advertisement.

Audio, Video, and other Electronic Data. Audio, electronic, visual, or similar information such as photographs, call recordings, and other audio recordings (e.g., recorded meetings and webinars).

Employment-Related Information and History. Professional or employment-related information, such as the Employee’s CV, resumé, references, qualifications, details of any assessments and other information included in a resumé or cover letter or as part of the application process, proof of ability to work in the applicable jurisdiction, desired start date of employment, desired role and location, etc.

Education Information. Information about education history or background.

Profiles and Inferences. Inferences drawn from any of the information identified above to create a profile about a candidate reflecting the candidate’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Purposes for collecting and using Personal Information

The purposes for collecting and using Personal Information are those specified in Section 3 Above.

Data sharing; Which third parties process my Personal Information?

We may disclose the categories of Personal Information identified in Sections 2 and 3 above as set out in such Sections, as well as for the following business purposes:

• We may share your data with affiliates and subsidiaries within the Amagi group of companies and third-party providers. "Third-party providers" include third-party service providers (including contractors and designated agents). The following activities are carried out by third-party service providers: recruitment and IT services. 
• We may also share your personal information with other third parties, for example, in the context of the possible sale or restructuring of the business. We may also need to share your personal information with a regulator to comply with the law.

Categories of Recipients to Whom We May Disclose Personal Information

We may disclose Personal Information to the following categories of recipients:

• Service Providers. We may disclose Personal Information to our service providers who perform services on our behalf. Our service providers are required to take appropriate security measures to protect your personal information in line with our policies, and they are not permitted to use personal information for their own purposes. 
• Regulatory and Government Entities. To comply with our legal obligations and where otherwise permitted by law, we may disclose Personal Information to applicable regulatory and government entities. 
• Other Parties Upon Notice and/or Consent. Personal Information may also be disclosed as notified and/or when you consent.

Data retention

We will only retain your Personal Information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal or reporting requirements. To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements. 

Your duties, rights, and choices

1. It is important that the information in our records is accurate and up to date. If your Personal Information changes during your employment application, please contact us as set out in Section 10 of this Privacy Notice to update your information.
2. Your rights. You may have the right, depending on your jurisdiction, to one or more of the following:

Right to Know	The right to know about the Personal Information we have collected about you during the past 12 months or other required time period*: The categories and specific pieces of Personal Information we have collected about you; The categories of sources from which we collected the Personal Information; The business or commercial purpose for which we collected the Personal Information; The categories of Personal Information about you that we disclosed for a business purpose, and the categories of third parties to whom we disclosed that information for a business purpose;  The specific pieces of Personal Information about you that we collected or disclosed to third parties for a business purpose; The right to receive requested information in a readily usable format if provided electronically; and The right to update or correct any Personal Information that is out of date or incorrect. * Note: Under some State Privacy Laws, the above right to know is limited to events that occurred in the preceding 12 months, while other State Privacy Laws may have a different time limitation or no time limitation.
Right of Deletion	You have the right to ask us to delete the Personal Information we have collected from you, subject to exceptions the law provides.  For example, to the extent permitted by State Privacy Laws, we may deny a deletion request if retaining the information is necessary for us or our service provider(s) to: (a) complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you; (b) detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities; (c) debug products to identify and repair errors that impair existing intended functionality; (d) protect our legal interests, to defend our rights in a case of potential, threatened, or actual litigation, and to enforce our rights; (e) comply with a legal obligation and/or (f) fulfill internal and lawful uses that are compatible with the context in which you provided the information.
Right to Opt-Out of Sale or Sharing of Personal Information	You have the right to opt out of the sale and sharing of your Personal Information. We do not “sell” or “share” Personal Information we collect from candidates. We also do not have actual knowledge that we Sell or Share the Personal Information of individuals under 16 years of age.
Right to Limit Use and Disclosure of Sensitive Personal Information	Subject to certain conditions and exceptions, you may have the right to limit the use and disclosure of Sensitive Personal Information, as defined under State Privacy Laws. However, we do not engage in activities triggering this right; therefore, no limitations are needed.
Right of Non-Discrimination	You have the right to not be discriminated against if you exercise these privacy rights. We will not discriminate against you, deny, charge different prices for, or provide a different quality of goods or services if you choose to exercise these rights.
Notice at Collection	At or before the point of collection, notice must be provided to the individual of the categories of Personal Information collected and the purposes for which such information is used.
Exceptions to These Rights	The law provides for certain exceptions to the rights described above. We reserve the right to avail ourselves of these exceptions where applicable.
Right to Appeal	You may appeal our decision with respect to a request you have submitted by emailing us.

1. What we may need from you. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that Personal Information is not disclosed to any person who has no right to receive it.
   
   

Exercising Your Privacy Rights (Applicable States)

To exercise any of the rights detailed above, please contact us as set out in Section 10 of this Privacy Notice.

If you email us, please indicate that you are exercising your “State Privacy Law rights.” We will need to confirm your identity before fulfilling the request, so please provide us with your full name and the email address you used to communicate with us. In some cases, we may request additional information to verify your identity or, where necessary, to process your request. If we are unable to verify your identity after a good-faith attempt, we may deny the request and, if so, will explain the basis for the denial.

You may designate someone as an authorized agent to submit requests and act on your behalf. To do so, you must provide us with written permission to allow the authorized agent to act on your behalf. We may also ask you directly to verify that you have authorized your authorized agent to act on your behalf.